Belgium Act of 30 July 2018

Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data — Belgian Federal Parliament

Also known as: Belgian DPA Act, Act of 30 July 2018, Belgium Act 8 1992, Loi du 30 juillet 2018, APD, GBA

Official site Official change log Subscribe to Belgium Act of 30 July 2018 (RSS)

Current version: Act of 30 July 2018 (as last amended by the Act of 30 March 2026); Published 30 March 2026. source
Status: In force
Next deadline: None announced
Who must comply: Processing in the context of a Belgian establishment, and processing of people in Belgium by controllers outside the EU that offer them goods or services or monitor their behaviour; separate titles cover police, intelligence and other authorities. source

How it is assessed: Controllers comply themselves under the GDPR, with extra measures the Act requires for genetic, biometric and health data. source
Authority: A Belgian federal act published in the Moniteur belge on 5 September 2018; the competent supervisory authority's GDPR corrective powers extend to the Act's own provisions. source
Enforced by: The supervisory authority's corrective powers reach the Act's provisions, GDPR fines do not apply to most public authorities, and Title 6 sets criminal penalties. source
Last change: None recorded yet

Belgium's national data protection act, the statute that fills in what the GDPR leaves to member states and that gives the Belgian Data Protection Authority its powers. It replaced the earlier Belgian privacy act.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates

Amendments

2026-03-30
Act of 30 July 2018 (as last amended by the Act of 30 March 2026) AmendmentCurrent text
The Act aligning justice legislation with the Criminal Code of 29 February 2024 recasts the criminal penalties of Title 6 as level 1 penalties; it was published on 2 April 2026 and takes effect on 1 September 2026. source
More
- By derogation from the Criminal Code, the maximum fine is EUR 120,000 for the offences of Article 222 and EUR 240,000 for those of Article 223.
2024-06-02
Amended by the Act of 2 June 2024 Amendment

Act amending the law of 11 December 1998 on security classification and clearances and the 2018 Act; its changes to Articles 72, 105-107, 111 and 138 apply from 1 February 2025. source
2024-03-29
Amended by the Act of 29 March 2024 (T.E.R. database) Amendment

Act creating the joint database "Terrorism, Extremism, Radicalisation process" (T.E.R.), which amends Article 11 and several provisions of Title 3; its changes to the Act apply from 1 October 2024. source
2018-07-30
Act of 30 July 2018 Major version

The Act on the protection of natural persons with regard to the processing of personal data, published on 5 September 2018 and in force from that day. source

Who it applies to

The Act applies to processing tied to a Belgian establishment and to non-EU controllers targeting people in Belgium; it also regulates processing by police, intelligence and other authorities in separate titles.

Establishment: Processing in the context of the activities of a controller's or processor's establishment in Belgium, whether or not the processing takes place there (Article 4(1)). source
Non-EU controllers: Processing of data of people in Belgium by a controller or processor not established in the EU, where it relates to offering them goods or services or monitoring their behaviour in Belgium (Article 4(2)). source
Children's consent: For information society services offered directly to children, consent is valid from age 13; below 13 it must come from the child's legal representative (Article 7). source
Authorities: Title 2 covers processing by competent authorities for criminal law purposes, Title 3 processing by other authorities such as the armed forces and the threat analysis body. source

How compliance is assessed

Controllers comply themselves under the GDPR, with extra measures the Act requires for genetic, biometric and health data.

Sensitive data measures: When processing genetic, biometric or health data, the controller designates the categories of people with access and their roles, among other additional measures (Article 9). source

Enforcement and penalties

The supervisory authority's corrective powers reach the Act's provisions, GDPR fines do not apply to most public authorities, and Title 6 sets criminal penalties.

Criminal fine up to EUR 120,000

Level 1 penalty for controllers, processors or their agents who, for example, process data without a legal basis or ignore a corrective order (Article 222, as amended with effect from 1 September 2026). source

Criminal fine up to EUR 240,000

Level 1 penalty for controllers or processors who, through serious negligence or malice, tell a data subject about data from, or disclosed to, a Title 3 authority in breach of Articles 11-12 (Article 223, as amended with effect from 1 September 2026). source

Corrective powers: The supervisory authority's corrective powers under GDPR Article 58(2) also apply to Articles 7-10, 20-24, 28-70 and Title 4 of the Act (Article 221(1)). source
Public authorities: GDPR Article 83 fines do not apply to public authorities and their agents, except public law legal persons that offer goods or services on a market (Article 221(2)). source

Documents

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Belgium Act of 30 July 2018 (RSS)

At a glance