#Why GDPR applies to every Belgian website
The GDPR (Regulation EU 2016/679) applies the moment a website collects any personal data of an EU resident: an email in a contact form, an IP address logged by Google Analytics, a cookie used to measure traffic.
In Belgium, it is supplemented by the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. The Belgian regulator is the Data Protection Authority (DPA) — Autorité de protection des données (APD) in French, Gegevensbeschermingsautoriteit (GBA) in Dutch.
Whether you are an SME with five employees or a sole trader, the moment your site has a contact form you are processing personal data. GDPR applies. There is no SME exemption.
#Penalties: what Article 83 of GDPR says
GDPR fines come in two tiers:
- Up to €10 million or 2% of global annual turnover (whichever is higher) for administrative breaches (records, security, breach notification).
- Up to €20 million or 4% of global annual turnover for breaches of core principles (legal basis, consent, data subject rights, transfers outside the EU).
The Belgian DPA can also issue warnings, formal notices, bans on processing, and publish its decisions — a non-trivial reputational hit.
#The 6 core principles (Article 5)
Article 5 sets the foundation. Every processing activity on your site must comply with:
- Lawfulness, fairness, transparency — the user knows what you do with their data.
- Purpose limitation — data collected for X is not reused for Y.
- Data minimisation — collect only what is necessary.
- Accuracy — data must be up to date; users must be able to correct it.
- Storage limitation — you don't keep data forever.
- Integrity and confidentiality — technical security (HTTPS, strong passwords, restricted access).
The accountability principle (Article 5.2) goes further: you must be able to demonstrate compliance. Without documentation, you are non-compliant even if everything else is in order.
#Legal bases: what gives you the right to process?
Every processing activity must rely on one of the 6 legal bases in Article 6. For a typical website:
| Processing | Appropriate legal basis |
|---|---|
| Contact form | Consent OR legitimate interest |
| Marketing newsletter | Explicit consent (opt-in) |
| E-commerce account | Performance of a contract |
| Invoicing, accounting | Legal obligation |
| Audience analytics cookies | Consent (with strict exceptions) |
| Strictly necessary cookies | No consent required |
| Marketing / retargeting cookies | Explicit consent |
Common mistake: relying on "legitimate interest" for everything. For marketing, newsletters and non-essential cookies, consent is mandatory.
#Cookies: what the Belgian DPA's Recommendation 01/2023 requires
The Belgian DPA published its Recommendation 01/2023 in February 2023 on the use of cookies and trackers. Combined with the ePrivacy Directive 2002/58/EC (transposed in Belgium into the Electronic Communications Act), it sets strict rules.
#What your cookie banner must do
- Ask for prior consent: non-essential cookies are not dropped before user action.
- Refusing must be as easy as accepting: a "Reject all" button at the same visual level as "Accept all". An "Accept" button alone, or a "Reject" buried under three menus, is not valid consent.
- No pre-ticked boxes (CJEU Planet49 ruling, C-673/17).
- Granularity: allow consent per category (analytics, marketing, etc.).
- Continued browsing ≠ consent.
- Withdrawal must be as easy as giving consent.
- Consent storage: 6 to 13 months maximum is the recommended window before re-asking.
#Cookies allowed without consent
Only strictly necessary cookies are allowed without consent:
- Session cookies, cart, authentication
- Language preference (when actively chosen by the user)
- Anti-fraud security cookies
Audience analytics tools are exempt only under very narrow conditions: no cross-referencing, anonymised IP, statistical purpose only. Standard Google Analytics does not meet these criteria and therefore requires consent.
#Mandatory information on your site
#1. Privacy policy
The central document. Article 13 of GDPR lists the information to provide at the time of collection:
- Identity and contact details of the controller
- DPO contact details if appointed
- Purposes and legal basis
- Legitimate interests pursued, if relied upon
- Recipients of the data (processors: hosting, CRM, email, etc.)
- Transfers outside the EU and safeguards
- Retention period or criteria
- Data subject rights: access, rectification, erasure, restriction, portability, objection
- Right to withdraw consent at any time
- Right to lodge a complaint with the DPA
- Whether providing data is mandatory or optional
- Existence of automated decision-making (profiling)
#2. Legal notice (mentions légales)
Required by Articles VI.45 and XII.6 of the Belgian Code of Economic Law:
- Name / company name
- Geographic address (registered office, not a P.O. box)
- Email and phone number
- Company number (BCE / VAT)
- Competent commercial register (RPM)
- For regulated professions: order, supervisory authority, applicable rules
#3. T&Cs for e-commerce
Additional obligation if you sell online (Book VI of CDE: 14-day right of withdrawal, 2-year legal warranty, mention of the EU ODR platform, etc.).
#User rights (Articles 15–22)
Every visitor whose data you hold can exercise:
| Right | Article | In practice |
|---|---|---|
| Access | 15 | Get a copy of the data held about them |
| Rectification | 16 | Correct inaccurate data |
| Erasure | 17 | "Right to be forgotten" — under conditions |
| Restriction | 18 | Temporarily freeze processing |
| Portability | 20 | Receive data in a structured format (CSV, JSON) |
| Objection | 21 | Object to processing (esp. direct marketing) |
| Automated decisions | 22 | Refuse a purely algorithmic decision |
You have 1 month (extendable by 2 months for complex cases) to respond, free of charge. Late or absent responses are one of the most common grounds for DPA complaints.
#DPO (Data Protection Officer): who needs one?
Article 37 mandates a DPO in 3 cases:
- You are a public authority or body.
- Your core activities involve regular and systematic monitoring at a large scale.
- Your core activities involve large-scale processing of sensitive data.
The vast majority of Belgian SMEs and freelancers are not subject to this requirement. Designating an internal contact and documenting their duties is good practice nonetheless.
#Records of processing activities (Article 30)
A mandatory internal document for any company with 250+ employees, and for smaller structures whose processing is not occasional, presents a risk to individuals, or involves sensitive data. In practice: nearly every site that collects leads or maintains a customer database needs one.
It must include, per processing activity:
- Controller's name and contact details (and DPO if applicable)
- Purposes
- Categories of subjects and data
- Categories of recipients
- Transfers outside the EU
- Retention periods
- Description of security measures
The Belgian DPA provides a free Excel template on its official website.
#Processors: a contract (Article 28) is mandatory
Any provider that processes data on your behalf is a processor under GDPR:
- Hosting (OVH, Combell, Vercel…)
- Email platform (Mailchimp, Brevo, ActiveCampaign)
- CRM (HubSpot, Pipedrive)
- Analytics (Google Analytics, Plausible, Matomo)
- E-commerce platform (Shopify, hosted WooCommerce)
You must sign a DPA (Data Processing Agreement) with each. Most large vendors offer a standard DPA online. A web project that has not listed its processors and signed DPAs is non-compliant, even if everything else is perfect.
#Transfers outside the EU: the sensitive topic
Many US-based tools transfer data to the United States. Since the Schrems II ruling (CJEU, July 2020), the Privacy Shield was invalidated. The EU-US Data Privacy Framework, in force since July 2023, restored an adequacy decision — but only for companies certified under the DPF.
For each tool, check:
- Is the vendor DPF-certified (lookup: dataprivacyframework.gov)?
- Otherwise, are Standard Contractual Clauses (SCCs) signed and supplemented by a Transfer Impact Assessment (TIA)?
- Is EU-region storage available (often in Enterprise plans)?
#Data breach notification (Article 33)
In case of a breach (hack, leak, misconfiguration), you have 72 hours to notify the DPA if the breach poses a risk to individuals. If the risk is high, affected individuals must also be informed (Article 34).
The Belgian DPA accepts notifications via an online form on its official site. Even non-notifiable breaches must be documented internally.
#Compliance checklist: 12 actionable items
For a typical SME / freelancer site, the essentials:
- ✅ HTTPS active on the entire site (valid SSL)
- ✅ Privacy policy complete and aligned with Article 13
- ✅ Legal notice compliant with the CDE
- ✅ Cookie banner with "Reject all" at the same visual level as "Accept all"
- ✅ No non-essential cookies before consent
- ✅ No pre-ticked boxes on forms (newsletter, etc.)
- ✅ Right to object mentioned on every marketing email (1-click unsubscribe)
- ✅ Records of processing kept up to date
- ✅ DPAs signed with each processor
- ✅ Documented process to respond to data subject requests within 1 month
- ✅ Documented security measures (strong passwords, MFA, backups, logging)
- ✅ Breach notification procedure ready (who to contact, in what timeframe)
#Common mistakes flagged by the Belgian DPA
Based on public DPA decisions in recent years, the recurring shortcomings are:
- Non-compliant cookie banner ("Accept" more prominent than "Reject", or no reject button)
- Cookies dropped before consent (notably Google Analytics, Meta Pixel)
- Failure to respond to access requests or responses past the 1-month deadline
- Generic privacy policy copied from another site, missing required mentions
- Newsletter without active opt-in
- No DPA signed with main processors
- Indefinite retention of leads in the CRM
#How much does compliance cost for an SME site?
For a Belgian SME's brochure or e-commerce site, in 2026:
- Initial GDPR audit by a specialist consultant: €800 – €2,500
- Consent Management Platform (CMP): €0 – €100/month (Cookiebot, Axeptio, Didomi, or open-source like Klaro)
- Drafting of legal notices by a lawyer: €400 – €1,200
- External DPO (if required): €150 – €600/month
A solid level of compliance is achievable for €1,500 – €4,000 in initial investment, plus a small monthly fee for the CMP. Compare that to the €20 million maximum fine.
#FAQ
#My site only has a contact form — am I really concerned?
Yes. The moment a name and email are collected, you process personal data. A privacy policy, legal notice and basic security are mandatory.
#Is Google Analytics banned in Belgium?
No, but standard usage requires prior, explicit consent via a compliant cookie banner. Alternatives include Plausible (EU-hosted) or self-hosted Matomo, which — depending on configuration — may not require consent.
#Does my SME need a DPO?
In most cases, no. A DPO is mandatory only for public authorities and companies whose core activities involve large-scale monitoring or sensitive data. Appointing an internal point of contact is still good practice.
#Can I copy the privacy policy of another site?
No. Each policy must reflect your purposes, your processors, your retention periods. A generic copied policy is among the most frequently flagged shortcomings by the Belgian DPA.
#How long can I keep leads from a contact form?
There is no fixed period in GDPR — only the principle of proportionality. For a non-converted lead, 2 to 3 years is a generally reasonable range. For an active customer, retention runs through the contractual relationship plus statutory periods (often 7 years for Belgian accounting).
#What if I receive a complaint from the Belgian DPA?
Respond promptly and precisely. The DPA often takes an educational approach before sanctioning, provided you demonstrate good faith and remediate. Engage a specialised lawyer from the first letter.
The takeaway: GDPR compliance is not a project you "finish". It's an ongoing process of documentation, processor reviews and improvement. But 80% of the value comes from a few weeks of structured work — one of the best investments a Belgian SME can make, both for regulatory risk and customer trust.
LeadCo Agency
Founder of LeadCo
Web developer and conversion expert based in Brussels. I build websites that turn your visitors into paying customers.
Discover our servicesContinue reading
