GDPR for Belgium

Belgium's data protection authority (GBA in Dutch, APD in French) issued one of the most significant GDPR decisions in 2022: a €250,000 fine against IAB Europe for violations in the Transparency and Consent Framework (TCF), the consent infrastructure used by most of the online advertising industry. The case established that consent strings used in real-time bidding constitute personal data — with major implications for adtech globally.

Brussels is home to the European Parliament, European Commission, and numerous EU regulatory bodies. Companies with Brussels operations face heightened scrutiny — regulators, journalists, and advocacy groups are concentrated here and actively monitor GDPR compliance.

Belgium's GDPR implementation law (the Act of 30 July 2018) contains national derogations for scientific research, journalism, and public interest processing. For B2B companies operating in Belgium, the practical impact is modest — the national law primarily affects public sector and research institutions.

The GBA has been particularly active on online advertising consent. Companies running behavioral advertising to Belgian users must comply with the IAB's revised TCF v2 framework (following the GBA order) — which requires clear, specific consent per advertising purpose and per vendor. Pre-checked boxes and "legitimate interest" claims for advertising are not accepted.

For companies choosing Belgium as their EU establishment (Brussels is a common choice due to its EU hub status), the GBA becomes your lead supervisory authority under the one-stop-shop mechanism. This has strategic implications for how cross-border complaints and investigations are handled.