GDPR and your website in Belgium: a compliance guide

This guide covers what a small business or a freelancer needs to put in place on their website, point by point. It does not replace legal advice for special cases (health data, profiling, large volumes).

#Why the GDPR applies to every website

A company of five and a sole trader are in the same boat: as soon as a name, an email address, a phone number or an IP address linked to a cookie is collected, personal data is being processed. There is no exemption for small businesses, only lighter obligations on a few points (the record of processing, for example).

#Fines

Article 83 of the GDPR sets two tiers of fines:

• up to €10 million or 2% of worldwide annual turnover (whichever is higher) for organisational failures: records, security, breach notification;
• up to €20 million or 4% for breaches of the core principles: legal basis, consent, data subjects' rights, transfers outside the EU.

The Belgian DPA can also issue a warning, order compliance, ban a processing operation and publish its decision, which often weighs more heavily than a fine for a small business.

#The 6 principles to respect (Article 5)

1. Lawfulness, fairness, transparency: people know what you do with their data.
2. Purpose limitation: data collected to answer a quote request is not used for something else without a legal basis.
3. Data minimisation: only ask for what you need.
4. Accuracy: data is kept up to date and can be corrected.
5. Storage limitation: nothing is kept forever.
6. Integrity and confidentiality: HTTPS, restricted access, strong passwords, backups.

#Legal bases: on what grounds do you process data?

Each processing operation needs one of the six legal bases in Article 6. For a typical website:

#Cookies

#What your cookie banner must do

• Ask before setting anything: no non-essential cookie loads before someone clicks to accept.
• Make refusing as easy as accepting: a "Reject all" button at the same level and as visible as "Accept all". A refusal hidden behind several clicks is not valid.
• Pre-tick nothing: the EU Court of Justice confirmed this in the Planet49 ruling (1 October 2019, C-673/17).
• Allow choices by category: analytics, advertising, embedded content.
• Not treat browsing as consent: carrying on scrolling does not count as agreement.
• Let people change their mind at any time, for example through a "Manage cookies" link in the footer.
• Keep a record of consents, and ask again regularly.

#Cookies allowed without consent

Only strictly necessary cookies: session, basket, login, security, remembering the language choice or the cookie choice itself.

#Analytics and embedded content

#Mandatory information on your website

#1. The privacy policy

• the identity and contact details of the controller (your business);
• the contact details of the data protection officer, if you have one;
• the purpose and legal basis of each processing operation, and the legitimate interest pursued where relevant;
• the recipients of the data (host, CRM, email tool…);
• transfers outside the EU and their safeguards;
• retention periods;
• people's rights and how to exercise them;
• the right to withdraw consent at any time;
• the right to lodge a complaint with the Data Protection Authority;
• whether providing the data is mandatory or optional;
• any automated decision-making or profiling.

#2. The legal notice

The Belgian Code of Economic Law requires you to display: name or company name, geographical address (not just a PO box), email address, enterprise number (Crossroads Bank for Enterprises) and VAT number, and, for a company, the competent register of legal entities. Regulated professions add their professional body or supervisory authority and the professional rules that apply.

#3. Online sales terms

#Visitors' rights (Articles 15 to 22)

#The data protection officer (DPO)

#The record of processing activities (Article 30)

Simplifications for SMEs are being discussed at EU level (the "digital omnibus" package, on which the Council adopted its position in October 2026). Until they are adopted, the current rules apply.

#Processors: a contract for each one (Article 28)

• your website host;
• your email tool and CRM;
• your analytics tool;
• your online shop platform;
• the agency that manages your website or campaigns, if it has access to the data.

#Transfers outside the European Union

For each tool, check:

• whether the company is certified (public list on dataprivacyframework.gov);
• if not, whether standard contractual clauses are signed, with a transfer risk assessment;
• whether there is an option to host the data within the EU.

#Data breaches (Articles 33 and 34)

#Beyond the GDPR: what changed in 2025 and 2026

• Accessibility: since 28 June 2025, the European Accessibility Act sets accessibility requirements for online sales services aimed at consumers. Micro-enterprises providing services (fewer than 10 people and no more than €2 million in turnover or balance sheet) are in principle exempt.
• Withdrawal function: mandatory for online sales since 14 August 2026.
• ODR platform: closed since 20 July 2025.
• AI assistants on your site: the EU Artificial Intelligence Act requires you to tell visitors clearly when they are interacting with an AI; these transparency obligations apply gradually from August 2026.

#The 12-point checklist

1. HTTPS across the whole site.
2. A complete privacy policy (Article 13), specific to your business.
3. A legal notice that complies with the Code of Economic Law.
4. A cookie banner with "Reject all" as visible as "Accept all".
5. No non-essential cookie before consent (check the browser's Network tab).
6. No pre-ticked boxes in forms.
7. An unsubscribe link in every marketing email.
8. An up-to-date record of processing.
9. A signed data processing agreement with each provider.
10. A procedure for answering access or erasure requests within one month.
11. Documented security measures: passwords, two-factor authentication, backups, updates.
12. A breach procedure ready: who does what within 72 hours.

For online sales, add: terms and conditions, the withdrawal function, mediation information and an accessibility check.

#The most common mistakes

• A banner with no real reject button, or an "Accept" far more visible than "Reject".
• Google Analytics or the Meta pixel loading before consent.
• A privacy policy copied from another website: it describes other tools and other retention periods.
• A newsletter without a checkbox, or with a pre-ticked one.
• Access requests left unanswered beyond one month.
• Contacts kept forever in the CRM.
• No contract with the host or the email tool.

#Frequently asked questions

#My website only has a contact form: does this apply to me?

Yes. As soon as a name and an email address are collected, personal data is being processed. You need at least a privacy policy, a legal notice and basic security measures.

#Is Google Analytics banned in Belgium?

No, but it may only be switched on after the visitor consents, through a compliant banner. Cookie-free tools such as Plausible can reduce that need, depending on their configuration.

#Does my small business need a DPO?

In the vast majority of cases, no. It is only mandatory for public bodies and for large-scale monitoring or processing of sensitive data.

#Can I copy another website's privacy policy?

No. It must describe your processing, your tools, your processors and your retention periods. A generic policy is one of the most frequently reported failings.

#How long can I keep contacts from a form?

The GDPR sets no fixed period: it must be proportionate. For a prospect who didn't follow up, two to three years is a generally accepted period. For a client, invoicing data is in practice kept for 10 years, the retention period for tax and VAT purposes.

#What should I do if I get a letter from the DPA?

Reply quickly and precisely, fix the issue and document what you did. The Authority often favours bringing businesses into compliance when they cooperate. Get help from a lawyer from the first letter.