Belgium: New procedure for notifying data breaches

The Belgian Data Protection Authority (DPA) recently launched its new online portal for reporting data breaches. It’s accessible on the Belgian DPA website, with relevant guidance.

Previously, a data breach could be notified by completing a smart form and uploading it via the DPA’s website. The new procedure is somewhat more extensive and requires companies to create an account and/or delegate roles via the eGov platform.

For establishments registered in the Belgian Company Register, these steps require the involvement of a company’s legal representative and may be time-consuming. Other establishments (not registered in Belgium) need to create a company account on the new online portal to access the data breach notification form.

Controllers have to complete the first part of the notification form within 72 hours. They then have to complete the second part within 21 calendar days after submitting the first part.

Given the strict deadline of 72 hours for data breach notification under the GDPR, there may not be enough time to go through all the steps when the breach occurs. As a mitigation for some cases, most companies with a Belgian company number will in principle have the option to file the first part without registration. But it’s highly recommended to make the necessary preparations in advance.

In particular, the appropriate people need to have access to the new online portal for the organisation (in line with the data breach notification procedure). This is not only relevant for submitting notifications but also to become timely aware of follow-up communications from the DPA. The group of people with access should be sufficiently large to avoid problems in cases of absence or technical issues.

Data breach notification must be done in one of the official languages of Belgium: Dutch, French or German.

Finally, a similar procedure needs to be followed for notifying the designation of a Data Protection Officer to the DPA. For more information or further guidance on the data breach notification procedure in Belgium, please get in touch.