Joris DeeneTen years after the adoption of the General Data Protection Regulation, an employer in Belgium must be able to demonstrate five things: a valid legal basis for each processing activity (consent is rarely sufficient), a retention policy for each category of HR data, a proportionate monitoring policy, a functioning procedure for access requests, and a departure procedure that closes a former employee’s email account within one month. We will discuss these obligations based on the most recent decisions of the Data Protection Authority’s Dispute Chamber and outline what employers must do in practice today.
In short:
- On May 12, 2026, the Dispute Chamber of the Data Protection Authority imposed two fines totaling 176,946.61 EUR because the email account of a former consultant had not been closed, and reiterated that the permitted period is, in principle, one month.
- According to the Dispute Resolution Board, an employee’s consent is generally not a valid legal basis.
- A request for access must be answered within one month and must not be left unaddressed by the HR department or the supervisor; the employer must therefore establish in advance who is responsible for identifying and handling such requests.
Why the Employment Relationship Raises Data Protection Standards
The General Data Protection Regulation (GDPR) was adopted on April 27, 2016, and has been directly applicable in all member states since May 25, 2018. In Belgium, it is supplemented by the Act of July 30, 2018, on the Protection of Individuals with Regard to the Processing of Personal Data. You can find the general framework on our page about the data protection law; this concerns only its application in the workplace.
According to Article 4(1) of the GDPR, personal data is any information relating to an identified or identifiable natural person. This definition is broad. It includes not only a name or address, but also a photograph, a professional email address, an IP address, login credentials, or an employee ID number. According to Article 4(2) of the GDPR, “processing” refers to virtually any operation performed on such data, from collection to erasure.
In the workplace, these two concepts constantly intersect. The employer collects data during the hiring process, maintains it for payroll purposes, supplements it during performance reviews and training, and monitors the use of company resources. In doing so, the employer is in a position of authority over an employee who depends on the employer. This hierarchical relationship explains why Article 88 of the GDPR allows for special national rules in the employment context, and why the Disputes Chamber holds the employer, as the data controller, to a stricter standard than a business would be held to in its dealings with a customer. According to Article 4(7) of the GDPR, a data controller is the party that determines the purposes and means of processing; in the employment relationship, this is almost always the employer.
Recruitment and Selection: What Information Can an Employer Ask a Job Applicant For?
It all starts with the principle of data minimization set forth in Article 5(1)(c) of the GDPR. A prospective employer may only request the data necessary to assess whether a candidate is suitable for the position. In the context of employment law, that principle is supplemented by Collective Bargaining Agreement No. 38 of December 6, 1983, regarding the recruitment and selection of employees, which requires the employer to respect the applicant's privacy and to treat the information obtained as confidential.
A distinction must be made depending on the stage of the procedure. During the initial screening, limited information is sufficient. Only once a decision has been made and preparations for the new hire are underway do details about the candidate’s family situation become relevant—for example, for withholding tax or enrolling in insurance. Therefore, asking about a partner’s occupation during a job interview is generally not justifiable. Employers should therefore periodically review their standard questionnaires and interview scripts in this regard.
When it comes to sensitive data, the bar is set higher. Article 9 of the GDPR generally prohibits the processing of data concerning health, trade union membership, ethnic origin, or sexual orientation, unless one of the exceptions applies, such as the need to comply with obligations under labor or social security law. Questions about a job applicant’s health or pregnancy are therefore generally not permitted, unless the position involves specific risks. Since the Directive (EU) 2023/970 on pay transparency In addition, there will be a ban on asking job applicants about their current or previous salary.
That prohibition remains in effect after the employee starts work, and it also applies to information the employee discloses on his or her own initiative. In the Warning and Reprimand No. 113/2021 In a decision dated October 11, 2021, the Dispute Resolution Chamber reprimanded a school because information about a teacher’s health—which he had shared in confidence with his principal—had been disclosed to the school’s governing body and other school administrations. The information had been provided within the context of a confidential relationship and was not to be shared beyond that context.
Criminal records are subject to their own set of rules. Article 10 of the GDPR subjects them to strict conditions, so that an employer cannot routinely require a criminal record check from every candidate. Only for certain positions, such as those in the security sector, does the law provide for specific requirements regarding criminal history.
Anyone wishing to conduct a background check must first determine whether the information can be obtained directly from the candidate. A reference check requires the applicant’s specific and informed consent, and a refusal should not, in and of itself, lead to rejection. When it comes to social media, “publicly accessible” does not mean “freely usable”; we discussed the boundaries earlier in the blog post addressing the question of whether a Employers may screen online profiles during the job application process.
Two practical points conclude this phase. Anyone who engages an external recruiter must determine in advance whether that recruiter is a processor (in which case a data processing agreement is required under Article 28 of the GDPR; see our page on the processing agreement), an independent data controller, or a joint controller within the meaning of Article 26 of the GDPR. And the data of rejected candidates are, in principle, erased as soon as it is established that no employment contract will be concluded; longer retention in a candidate pool requires separate consent that cannot be inferred from participation in the selection process. The Dispute Resolution Chamber added the following on November 28, 2025, in the Decision No. 200/2025 Furthermore, when a job applicant submits a request for access, they must be specifically informed of the source of their data, which data comes from which source, and in what form.
An employee's consent: rarely the solution, but not always out of the question
All processing must be based on one of the legal grounds set forth in Article 6 of the GDPR. In the employment relationship, these are primarily the performance of the employment contract (wages, work organization), legal obligations (social and tax law), and legitimate interests. Legitimate interest is the legal basis under which the employer must demonstrate a genuine and legitimate interest, prove that the processing is necessary for that purpose, and verify that the employee’s rights do not outweigh those interests. This three-part test must be documented in advance and in writing; it must not be a catch-all category that the employer resorts to when a complaint is received.
Consent is at the bottom of the list. The Disputes Chamber has repeatedly ruled that, given the relationship of authority, an employee cannot, in principle, give free consent when the employer is the data controller. It did so, among other things, in the Order No. 35/2024 dated February 20, 2024, and in the Decision No. 114/2024 dated September 6, 2024, regarding time tracking using biometric data. According to that interpretation, consent is generally not a valid legal basis in the workplace.
It is true, however, that the Dispute Resolution Chamber in the Decision No. 72/2020 In its ruling of November 9, 2020, the court did, however, accept that an employee could validly consent to the processing of information regarding his union membership, because such processing was carried out exclusively for his benefit and the employer derived no benefit from it. An employee can therefore, despite their subordinate position, freely consent when they have complete freedom to refuse and when refusing does not entail any direct or indirect disadvantage.
The latter is also legally defensible. Article 7 of the GDPR and Recital 43 do not rule out consent in an unequal relationship; they presume it to be non-free. This presumption can be rebutted. The problem lies in the evidence. According to Article 7(1) of the GDPR, the employer must be able to demonstrate that the consent was freely given, and that evidence is difficult to provide in an employment relationship once the processing also serves the employer’s interests. In the 2020 case, the processing served only the employee; in the 2024 biometrics case, it served the employer. We therefore believe that this is defensible for processing that is exclusively for the benefit of the employee (a birthday gift, a voluntary union dues deduction), but that it does not provide a legal basis for control, monitoring, or access management. In those cases, the legitimate interest—supported by a documented balancing test—remains the only viable legal basis.
Supervision and monitoring: necessity determines the approach, not the technology
An employer may oversee the performance of the work. This right to monitor stems from the employer-employee relationship, but it is not unlimited. The employer must not base decisions on what a system is technically capable of, but rather on what the employer actually needs. Before implementing a monitoring measure, the employer must specify the objective being pursued, the data required to achieve it, whether a less intrusive measure would suffice, who will have access to the results, and how long they will be retained.
Geolocation illustrates this point. A GPS system in a company vehicle can be used for theft prevention, scheduling, or keeping customers informed. The Dispute Resolution Board accepted in the Decision No. 15/2023 dated February 21, 2023, states that such objectives may be legitimate, but a system implemented for theft protection may not be used without further ado to monitor breaks or performance. For vehicles that are also used for personal purposes, a privacy mode or an option to disable tracking outside of working hours must prevent tracking during personal use. We analyzed a later decision on the same topic in the blog post addressing the question of whether a an employer may install a geolocation system in a company vehicle.
Social media requires the same level of restraint. The Dispute Resolution Chamber accepted in its Decision Without Consequences No. 06/2021 dated January 28, 2021, regarding an employer’s monitoring of working hours and social media, which states that an employee’s reasonable expectation of privacy diminishes to the extent that he or she voluntarily shares statements in the public sphere. This does not mean that publicly available information may be used for any purpose. Anyone who uses a screenshot or an online post in disciplinary proceedings is processing personal data and must, for that purpose, specify the purpose, limit the monitoring to what is relevant, and document why further verification was necessary. Occasionally reviewing a message brought to the employer’s attention is different from systematically monitoring all employees; the more systematic the monitoring, the more difficult it is to justify.
Remote work doesn’t change the rules, but it tempts people to resort to extreme measures. Systems that log keystrokes, automatically take screenshots, or track all digital activity are particularly intrusive and will be difficult to justify. Monitoring results or conducting limited checks on login times is generally the less intrusive alternative. Furthermore, when monitoring email and internet use, Collective Bargaining Agreement No. 81 of April 26, 2002 applies, with its own information and individualization procedure.
Can an employer require that the camera be turned on during a video conference? The employer may have a legitimate interest in doing so during a performance review or an interactive training session, but a general requirement for every online meeting is harder to justify than a specific rule tailored to each type of meeting. Can video calls be recorded? A recording permanently captures voices, images, statements, and shared documents and is therefore much more intrusive than the meeting itself. The argument that a recording “might be useful later” is not sufficient. Participants must be explicitly informed in advance about the purpose, access, and retention period; a recording icon in the meeting application is insufficient for this purpose. The Dispute Resolution Chamber confirmed the importance of this transparency on May 12, 2026, in the Decision No. 102/2026 regarding the recording and listening to of phone calls for quality control and training purposes.
Employee Rights: Access Does Not Constitute a Right to the Entire Mailbox
Employees have all the rights set forth in Articles 15 through 22 of the GDPR. In HR practice, the right of access carries the most weight. An employee may ask what data about them is being processed, for what purposes, to whom it is disclosed, and how long it is retained, and they are entitled to a copy.
That copy pertains to the personal data, not every document in which it appears. The employer must take into account the rights and freedoms of others. A request for access therefore does not grant unlimited access to entire email inboxes, internal reports, or files that also contain third-party data or confidential business information. The Dispute Resolution Board ruled in the Decision No. 40/2023 dated April 3, 2023, regarding a denial of access after the end of employment, and ruled in the same case that a functional email account managed by multiple employees may continue to exist after one of them leaves.
The deadline is strict. The employer must respond within one month; the employer may extend this deadline by two months if the complexity of the request or the number of requests warrants it, but must then inform the employee of the extension and the reasons for it within the first month. A request may not be left unaddressed by the supervisor or HR representative who receives it; this follows from the Decision No. 97/2026 dated May 6, 2026, regarding an unanswered request for a copy of performance reviews. Not every request refers to the GDPR. An employee who simply asks what data is being kept about them is already exercising their right of access. HR and managers must recognize this and forward the request internally.
The right to rectification (Article 16 of the GDPR) is limited to factual information; a negative evaluation cannot be “corrected,” but the employee may have his or her point of view added to the file. The right to erasure (Article 17 of the GDPR) is subject to statutory retention requirements and does not apply to data that remains necessary for legal proceedings. Data that may not be erased may therefore not be used for other purposes: the principle of purpose limitation continues to apply.
End of the Employment Relationship: The Email Inbox Poses the Greatest Risk of Penalties
After an employee leaves, the employer continues to process a significant amount of personal data. Some of this data must be retained to comply with social security, tax, or accounting obligations; other data may be retained to defend against potential legal claims, as permitted by Article 17(3)(e) of the GDPR. However, this does not justify the indefinite retention of the entire personnel file. The employer must determine, on a category-by-category basis, how long and why the data will be retained, and who still has access to it.
The email account is the most sensitive component. An email address that includes an employee’s first or last name constitutes personal data; in principle, third parties are not permitted to use that account. The Dispute Resolution Board has applied this rule since the Decision No. 64/2020 dated September 29, 2020, regarding the decision not to close the email account after the end of a position’s term: the mailbox is closed, a neutral automatic reply directs recipients to an alternative point of contact, and continuity is organized in a less disruptive manner. In principle, the period is one month; an extension to a maximum of three months requires an explicit balancing of interests. This policy was reiterated on April 23, 2026, in the Decision No. 86/2026.
On May 12, 2026, the most severe application to date took place. In the Decision No. 101/2026 The Dispute Resolution Chamber ruled on the case of a self-employed consultant who, as a member of the “extended workforce,” had a professional email address provided by the company. The email account remained active after the collaboration ended. The Dispute Resolution Chamber held that an email account inevitably contains a mix of company information, employee data, private communications, and third-party data, and that continued processing after the employee’s departure can only be based on a legitimate interest on a temporary basis. It ordered the company to take appropriate measures, grant access, delete the data in the mailbox, and hand over the access logs, and imposed fines of 160,860.55 EUR and 16,086.06 EUR. We discussed that decision in detail in the blog post addressing the question of whether the It is sufficient to deactivate a former employee's mailbox; the answer was no; deactivating is not the same as deleting.
Here, too, a note of caution is in order. The one-month period is not specified in the GDPR; it is the Dispute Resolution Chamber’s interpretation of the principle of storage limitation. However, it is a rule of practice. An employer wishing to justify a longer period could, in theory, do so with a documented balancing of interests, but the decision of May 12, 2026, shows that the Dispute Chamber interprets such justification strictly and that the cost of a failed attempt is high. The safest approach remains the handover before departure: the departing employee organizes their email inbox, deletes or moves personal messages, and transfers professional information to a colleague.
Freelancers, Processing Registry, and Enforcement
The GDPR applies equally to freelancers, independent consultants, temporary workers, and employees of service providers. A privacy notice written solely for employees does not cover their data processing, and anyone who processes personal data on behalf of the company needs a data processing agreement. The case of the consultant in Decision No. 101/2026 demonstrates that the Dispute Resolution Chamber does not make that distinction.
The record of processing activities referred to in Article 30 of the GDPR must reflect the actual situation. A new HR tool, a new access control system, or a new form of monitoring is a reason to update the record and to determine the legal basis in advance. A company should not wait until a complaint or a request for access is received before beginning to search for a legal basis.
Enforcement is a real possibility. Article 83 of the GDPR allows for fines of up to 20 million EUR or 4 percent of global annual revenue. In the Decision No. 56/2021 On April 26, 2021, the Dispute Resolution Chamber imposed a fine of 100,000 EUR on a financial institution because an employee had unlawfully accessed data in the National Bank’s credit registry; the employer remained liable, even though the employee had acted in violation of internal instructions. Internal policies are therefore not sufficient. The employer must be able to demonstrate that access rights are restricted, logged, and periodically reviewed.
Specifically, what does this mean?
Employers and HR Departments It is best to draw up a checklist with five items. A legal basis for each processing activity, determined in advance and, in the case of a legitimate interest, weighed in writing. A retention policy that specifies a retention period and a legal basis for each category of HR data (job applications, employment contracts, payroll, performance reviews, disability, audit data), and that is also implemented in local files and shared folders. A control policy that specifies the purpose, data, access, and retention period for each tool, including a privacy mode for company vehicles and differentiated rules for cameras and recording during video calls. An internal procedure that identifies requests for access to data and responds to them within one month. And a departure procedure in which HR and IT work together to deactivate accounts, recover devices, and clear the email inbox within one month. If you’re unsure whether your current IT policy and exit procedure meet these standards, that’s the first thing we’ll check for you; an employer who wants to address this systematically is best served by a lawyer specializing in GDPR/AVG.
For employees and former employees The focus is on rights. Anyone who wants to know what data the employer keeps does not need to submit a formal request citing the GDPR; a simple request for a copy is sufficient, and the employer must respond within one month. A former employee retains these rights as long as the employer continues to process their data and can therefore request access to information about what happened to their email account even after leaving the company. A refusal or failure to respond may be the subject of a complaint filed with the Data Protection Authority.
For freelancers and consultants Since the decision of May 12, 2026, contractors who provide an email address are entitled to the same protection as employees. It’s a good idea to agree in writing at the start of the assignment on what will happen to the email account once the assignment ends.
Frequently asked questions (FAQ)
What personal data may an employer process regarding its employees?
An employer may process the personal data necessary to fulfill the employment contract (identity, wages, working hours), to comply with its legal obligations (social security, tax authorities), and to pursue a legitimate interest, such as the security of company assets. The employer may process sensitive data—such as health information or union membership—only when an exception under Article 9 of the GDPR applies. The employee’s consent is rarely a valid legal basis.
Can my employer continue to use my email account after I leave?
No, not indefinitely. The Dispute Chamber of the Data Protection Authority expects the email account to be closed with a neutral automatic reply, and for the data it contains—including the email address itself—to be deleted after one month, in principle. An extension to three months is only possible following an explicit balancing of interests. Simply deactivating the mailbox is not sufficient; in May 2026, this resulted in fines totaling 176,946.61 EUR.
Can an employer require me to turn on my camera during every video conference?
A general requirement for every online meeting is difficult to justify. An employer may, however, require the use of a camera when visual interaction is necessary, such as during a performance review, an interactive training session, or a workshop. In doing so, the employer must balance the legitimate interest against the employee’s privacy, as the camera also captures the employee’s home and household members. A differentiated policy based on the type of meeting is the most defensible approach.
How quickly must an employer respond to an employee's request to access personal information?
Within one month of receipt. The employer may extend this period by two months if the request is complex or if there are a large number of requests, but must inform the employee of the extension and the reasons for it within the first month. The request does not need to refer to the GDPR; even a simple request for a copy of the data counts as a request for access and must be forwarded internally to the appropriate person for processing.
Conclusion
Ten years after the adoption of the GDPR, data protection in the workplace in Belgium is no longer just a matter of a privacy statement, but of demonstrable practices: a legal basis for each processing activity, a retention policy for each category, a proportionate audit policy, a functioning access procedure, and an exit procedure that clears the email inbox within one month.
ICT Rechtswijzer is the knowledge platform of the intellectual property, IT law, AI law, data protection, and media law department at Everest Advocaten, led by Joris Deene, Esq. Our attorneys assist employers in drafting their IT policies, data retention policies, and exit procedures, and represent employees and freelancers who wish to enforce their rights of access or erasure.
Dutch 
English