Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Belgium enforces GDPR through the Data Protection Authority (APD/GBA) and was among the first EU member states to transpose NIS2, via a Law of 26 April 2024 supervised by the Centre for Cybersecurity Belgium (CCB).
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Directly applicable EU regulation; sets the 72-hour breach notification standard and the €20m/4% fine cap uniformly across the EEA.
SourceBelgium's supplementary GDPR legislation, in force since 5 September 2018, replacing the 1992 privacy law and implementing several GDPR 'open clauses,' with most provisions addressing processing by public authorities.
SourceBelgium's NIS2 transposition, published 17 May 2024 and in force since 18 October 2024, among the earliest in the EU. An implementing Royal Decree designates the CCB as national cybersecurity authority and recognizes CyberFundamentals (CyFun) and ISO/IEC 27001 as compliance frameworks.
Source72 hours
Controllers must notify the APD/GBA without undue delay and, where feasible, within 72 hours of becoming aware of a breach, per GDPR Article 33.
Notify: APD/GBA (Belgian Data Protection Authority)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Fully transposed via the Law of 26 April 2024 (published 17 May 2024, in force since 18 October 2024), presented by Belgium's own cybersecurity authority as one of the first EU member states to complete transposition ahead of the 17 October 2024 deadline. The Centre for Cybersecurity Belgium (CCB) is the designated national cybersecurity authority and CSIRT.
SourceAutorité de protection des données / Gegevensbeschermingsautoriteit (Belgian Data Protection Authority)(APD/GBA)
Visit authority siteThe Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA), within 72 hours of becoming aware of the breach where feasible, per GDPR Article 33.
18 October 2024, under the Law of 26 April 2024, one of the earliest NIS2 transpositions in the EU, published in the Belgian Official Journal on 17 May 2024.
The Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority. It recognizes the CyberFundamentals (CyFun) framework and ISO/IEC 27001 certification as accepted routes for demonstrating NIS2 compliance.
Talk to us about scoping an engagement around your specific regulatory context.
