EU regulation

The GDPR contains a general requirement for a personal data breach to be notified by the controller to its supervisory authority, and for more serious breaches to also be notified to affected data subjects. A "personal data breach" is a wide concept, defined as any "breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed" (Article 4).

The controller must notify a breach to the supervisory authority without undue delay, and where feasible, not later than 72 hours after having become aware of it, unless the controller determines that the breach is unlikely to result in a risk to the rights and freedoms of natural persons. When the personal data breach is likely to result in a high risk to natural persons, the controller is also required to notify the affected data subjects without undue delay (Article 34).

Where the breach occurs at the level of the processor, it is required to notify the controller without undue delay upon becoming aware of the breach (Article 33(2)).

The notification to the supervisory authority must include where possible the categories and approximate numbers of individuals and records concerned, the name of the organisation’s data protection officer or other contact, the likely consequences of the breach and the measures taken to mitigate harm (Article 33(3)).

Controllers are also required to keep a record of all data breaches (Article 33(5)) (whether or not notified to the supervisory authority) and permit audits of the record by the supervisory authority.

Belgium regulation

No general additional requirements are inserted in the Data Protection Act relating to data breaches.

Data breach obligations are also detailed for each special regime, but they resemble those contained in the GDPR.

The Belgium Data Protection Authority has recently launched a new online portal for reporting data breaches. It is accessible on the Belgian Data Protection Authority, with relevant guidance.¹

Previously, a data breach could be notified by completing a smart form and uploading it via the Belgian Data Protection Authority's website. The new procedure is more extensive and requires companies to create an account and/or delegate roles via the eGov platform.² For establishments registered in the Belgian Company Register, these steps require the involvement of a company’s legal representative and may be time-consuming. Other establishments (not registered in Belgium) need to create a company account on the new online portal to access the data breach notification form. 

Controllers have to complete the first part of the notification form within 72 hours. They then have to complete the second part within 21 calendar days after submitting the first part. Given the strict deadline of 72 hours for data breach notification under the GDPR, there may not be enough time to go through all the steps when the breach occurs. As a mitigation for some cases, most companies with a Belgian company number will in principle have the option to file the first part without registration.