Last reviewed: January 2025

Yes.

The following are potential legal bases for processing personal data:

☒         the data subject has provided consent to the processing for the identified purposes

☒         the personal data is necessary to perform a contract with the data subject

☒         the personal data is necessary to comply with a legal obligation

☒         the personal data is necessary to protect the vital interests of a natural person

☒         the personal data is necessary for a public interest

☒         the personal data is necessary to fulfil a legitimate interest of the controller or third party (provided that the interest is not overridden by the data subject's privacy interests and the data subject has not made use of his/her right to object)

☒         other

Please see section "Is an identified legal basis required of processing different in order to collect or process sensitive personal data?" regarding personal data relating to criminal convictions and offenses or related security measures.

Last reviewed: January 2025

Yes

The following are potential legal bases for processing special categories of personal data:

☒         the data subject has given consent to the processing, where consent is measured to a higher standard than for non-sensitive personal data (for example, additional requirement for consent to be "explicit")

☒         processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

☒         processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

☒         processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and further conditions

☒         processing relates to personal data which are manifestly made public by the data subject

☒         processing is necessary for the establishment, exercise or defense of legal claims

☒         processing is necessary for reasons of substantial public interest

☒         processing is necessary for the purposes of medicine, the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services

☒         processing is necessary for reasons of public interest in the area of public health

☒         processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

☒         other

Art. 8 of the Belgian DPA specifies which processing may be considered necessary for reasons of substantial public interest (e.g., processing carried out by associations having legal personality or by foundations whose main statutory purpose is the defense and promotion of human rights and fundamental freedoms, or by associations having legal personality or by foundations whose main statutory purpose is to evaluate, guide and treat persons whose sexual conduct can be qualified as an offense, etc.).

Pursuant to Art. 10 of the DPA, processing of personal data relating to criminal convictions and offenses or related security measures may only be carried out:

• by natural or legal persons governed by public or private law as necessary for the management of their own litigation;
• by attorneys or other legal counsels as necessary for the defense of their clients;
• by other persons as necessary for reasons of substantial public interest for the performance of a task carried out in the public interest assigned by or under a law, decree or ordinance or EU law;
• as necessary for archiving purposes, scientific or historical research purposes, or statistical purposes;
• if the data subject explicitly authorized in writing the processing of their personal data for one or several purposes, provided that the processing is limited to such purposes; or
• if the processing concerns personal data manifestly made public by the data subject, on its own initiative, for one or several specific purposes, provided that the processing is limited to such purposes.

Last reviewed: January 2025

Yes

A minor within the meaning of Belgian DPA implementing Article 8.1 of the GDPR is a person below the age of 13 in the sense that the Belgian DPA provides that the processing of personal data of a child in relation to the offer of information society services directly to a child is lawful where the consent has been given by a child who is at least 13. Where the processing concerns personal data of a child below the age of 13, such processing shall be lawful only if that consent is given by the child's legal representative.

Last reviewed: January 2025

In the context of information society services only if processing is based on consent

Last reviewed: January 2025

☒         consent must be given or authorized by the holder of parental responsibility over the child 

☒         other

Please note that a minor will be considered a "vulnerable person", and therefore their information must be adapted and the contemplated processing may be considered a high risk and trigger a requirement to carry out a DPIA.