Is your government agency legally prepared for a cyberattack?

When hackers breached the City of Antwerp’s systems on the night of December 5–6, 2022, service counters, email systems, and even the medication registry of the Zorgbedrijf were down for weeks. Since then, the legal framework for cybersecurity at Belgian government organizations has been significantly tightened. Anyone who heads a local government, an agency, or another public organization today must ensure four things are in order: knowing whether the organization falls under the NIS2-act, meet the basic security requirements that are also mandatory outside the scope of that law, have two parallel reporting schedules ready for the day of the incident, and ensure that contracts with IT vendors are watertight. In this article, we’ll walk through those four steps.

The threat is no longer just a theory

The figures and case studies speak for themselves. The attack on Antwerp was a ransomware attack carried out by the hacker collective Play, which, according to VRT News stole more than 500 gigabytes of data and threatened to publish it on the dark web. The restoration of the last applications was completed by the end of January 2023. Also in December 2022, Diest and Zwijndrecht were affected. Smaller local governments have not been spared either: in 2025 and 2026, Walloon municipalities and PCSWs, among others, appeared on ransomware groups’ publication sites.

The Belgian Cybersecurity Center (CCB) had already recorded 120 reports of ransomware or extortion following data theft at private and public organizations combined in 2023, according to its Guideline No. 1/2024 to government agencies. The same guideline requires every government agency to enable two-factor authentication on all external connections and explicitly advises against ever paying a ransom.

Meanwhile, legal action is also underway. In a report on the attack on Antwerp - which VRT NWS was able to review in June 2024 - the Flemish Supervisory Commission for the Processing of Personal Data concluded that the city’s departments were insufficiently prepared: there was barely a recovery plan, important security updates had not been implemented, and two-factor authentication was largely absent. The report describes this as literally “embarrassing” for an organization of that size. A cyber incident is therefore not just an operational crisis; it is also the moment when a regulator scrutinizes the security measures in place prior to the incident.

Does your organization fall under the NIS2 Act?

The first legal question concerns the scope of application of the Act of April 26, 2024 establishing a framework for the cybersecurity of network and information systems of public interest for public safety, known as the NIS2 Act. This Act implements the European NIS2 directive It came into effect on October 18, 2024. In the public sector, it operates according to its own logic, which leads to surprising outcomes.

Government Agencies of the Federal State and the Subregions

Government agencies under the jurisdiction of the Federal State are subject to the law regardless of their size (Art. 3, § 3 of the NIS2 Act), and they qualify as critical entities. The same applies to the emergency response zones and the Brussels-Capital Region Fire and Emergency Medical Services. Government agencies under the jurisdiction of the federated entities, such as Flemish agencies, are only subject to the law after formal identification by the national cybersecurity authority (Art. 11, § 2 of the NIS2 Act). Therefore, any organization that receives such an identification decision does not need to assess the size thresholds itself: the decision itself brings the organization within the scope of the law.

Local governments: not automatic, but not secure either

Municipalities, provinces, public social welfare centers (PCSWs), and intermunicipal associations are not listed as such in the appendices to the law. The CCB takes the position that, in light of the local autonomy provided for in Article 162 of the Constitution, they do not “depend” on the Federal State or the regions, and therefore do not automatically belong to the public sector. However, that is not the end of the story, and this is the most common error in judgment made in practice.

A local government is subject to the NIS2 Act if it provides at least one service from another sector listed in the annexes to the Act—such as drinking water distribution, waste management, or the operation of a public hospital—and meets the size thresholds (50 full-time equivalents or 10 million euros in annual revenue or total assets). The fact that this service constitutes only a small part of the organization’s operations is, in principle, irrelevant: a single service listed in the annexes is sufficient, and the organization as a whole is then subject to the Act for all of its network and information systems. In addition, the CCB may still individually designate any governing body as an essential or important entity (Art. 11, § 1 of the NIS2 Act).Anyone who has been identified was required to register on the Safeonweb@Work portal by March 18, 2025, at the latest, and has been subject to all obligations since then: the risk management measures under Article 30, the reporting requirement, and oversight.

Not falling under NIS2 is not an exemption

For boards that fall outside the scope of the NIS2 Act, there is a second, lesser-known set of obligations. The Flemish Government stipulated in its Flemish Digital Security Policy Strategy that every Flemish government agency and every local government not covered by NIS2 must, by January 1, 2030, implement at least the “basic” security level of the CCB’s CyberFundamentals(CyFun) framework, or, alternatively, the ISO 27001 standard, by January 1, 2030. The Flemish Center for Digital Security, established within Digital Flanders on May 1, 2025, will oversee this and set an initial reporting milestone for 2026. Digital hygiene will thus become a requirement for every Flemish government body, large or small.

And then there's the layer that's always been there. The General Data Protection Regulation (GDPR) requires every data controller—including every board—to implement appropriate technical and organizational security measures (Art. 32 of the GDPR). A board processes national registration numbers, PCSW files, and personnel data, and bears a duty of accountability in this regard that the Data Protection Authority (DPA) enforces strictly. Just how strictly was evident from the decision we previously analyzed in our article on the question whether a municipality is liable when a public official unlawfully accesses the National Registry: Management remains ultimately responsible, even when an employee disregards strict instructions, as soon as the control systems fail.

The day of the incident: two incident logs side by side

When things go wrong, two legal timelines run simultaneously, each with different deadlines, recipients, and content. If you don’t monitor both tracks in parallel from the moment the issue is detected, you will inevitably miss a deadline.

The first channel is the NIS2 notification, for organizations subject to the law. They must report every significant incident to the national CSIRT at the CCB in three phases (Art. 35 of the NIS2 Act): an early warning within 24 hours of becoming aware of the incident, an incident report with an initial assessment within 72 hours, and a final report no later than one month after that incident report. In addition, the governing body must immediately inform the recipients of its services—in practice, citizens and partner organizations—if the incident could adversely affect their service provision (Art. 34 of the NIS2 Act). The law explicitly states that the report itself does not result in increased liability, which is an argument for reporting incidents in a timely and complete manner.

The second track is the data breach notification under the GDPR: as soon as the incident affects personal data and poses a risk to the data subjects, the notification must be submitted to the DPA within 72 hours (Art. 33 GDPR), and in the event of a high risk, the data subjects themselves must also be informed (Art. 34 GDPR). The CCB explicitly states that the NIS2 notification does not replace the GDPR notification. A single ransomware attack on a municipal server can therefore quickly result in three or four separate notifications within the first week. An administration that, following an incident, has doubts about the classification or content of those notifications would be well advised to seek assistance from a lawyer specializing in data protection: today's report is part of the file for tomorrow's investigation.

The board is responsible, not the IT department

The NIS2 Act explicitly places ultimate responsibility with top management. The governing body of an essential or important entity must approve the risk management measures, oversee their implementation, and is liable for any breaches of that obligation by the entity (Art. 31 of the NIS2 Act). Furthermore, members of the governing body must undergo training to be able to assess cyber risks. In addition, any natural person who represents the entity or exercises control over it is personally responsible for ensuring compliance with the Act (Art. 61 of the NIS2 Act). For a mayor, a general director, or the chairperson of an intermunicipal association, cybersecurity is therefore no longer a delegable IT issue, but a governance matter.

The sanctions regime does, however, provide for some leniency in the public sector. Against a government agency as defined by law, the competent authorities may take basic measures, such as issuing warnings and binding orders to remedy deficiencies (Art. 58 of the NIS2 Act), but they may not impose administrative fines (Art. 62 of the NIS2 Act). These fines are, however, substantial: up to 7 million euros or 1.4 percent of global annual revenue for a significant entity, and up to 10 million euros or 2 percent for a critical entity (Art. 59 of the NIS2 Act). Please note the limits of this exception. An entity of an industrial or commercial nature falls outside the definition of a public authority and may therefore be fined; this applies to some intermunicipal associations and public enterprises. Furthermore, immunity from fines does not affect the liability of the governing body and executives, nor does it preclude claims for damages from citizens or contracting parties following a preventable incident.

The weakest link is often the supplier

The risk management measures set forth in Article 30 of the NIS2 Act explicitly include supply chain security. A board must therefore not only secure its own systems but also manage the risks introduced by its IT suppliers, cloud partners, and software vendors. This is reflected in the specifications and the contract: security requirements and certifications as conditions for awarding the contract, audit rights, obligations to immediately report incidents at the supplier’s site, agreements regarding backups and recovery times, and a clear division of liability when an incident occurs at the supplier’s site. For a processor of personal data, the data processing agreement under Article 28 of the GDPR applies in addition to these requirements.

For public authorities, all of this takes place within the constraints of public procurement law, where poorly written specifications can have a lasting impact for years. We previously analyzed how a contracting authority can avoid these pitfalls—and why overreliance on a single supplier also poses a security risk—in our article on Vendor lock-in in government IT procurement. Cyber insurance can round out the picture, but it does not replace the investment in cybersecurity : in the event of a claim, the insurer first verifies whether the basic measures were in place.

Frequently asked questions (FAQ)

Does my municipality need to register under the NIS2 Act?
Only if it falls under the law. This is the case when the municipality or its privatized entity provides at least one service listed in the appendices to the law, such as drinking water, waste management, or a public hospital, and meets the size thresholds, or when the CCB has individually identified it as an essential or important entity. Registration takes place on the Safeonweb@Work portal; for most entities, the deadline passed on March 18, 2025, so anyone who has not yet registered should do so as soon as possible.

Is a board of directors allowed to pay a ransom after a ransomware attack?
There is no explicit legal prohibition, but the CCB strongly advises against payment in its Guideline No. 1/2024: paying perpetuates the criminals’ revenue model and offers no guarantee whatsoever of recovery or the destruction of stolen data. In 2022, the city of Antwerp publicly refused to make any payments or engage in negotiations. Furthermore, any administration considering payment must realize that such a payment does not affect reporting obligations or liability issues.

We are not subject to NIS2. Do we need to take any action?
Yes. For Flemish government agencies and local governments outside of NIS2, the Flemish digital security policy strategy applies: by January 1, 2030, at a minimum, the CyFun “basic” security level or ISO 27001 must be implemented. In addition, the security and reporting obligations under the GDPR apply in full to every government body, regardless of its size.

Conclusion

Under Belgian law, a government organization no longer has a choice as to whether or not to invest in cybersecurity; the law now only specifies the manner in which this obligation is imposed. Large and service-providing public authorities are subject to the NIS2 Act, which requires registration, risk management measures, a phased reporting obligation, and personal accountability on the part of the governing body. Those who fall outside this scope will still face the Flemish requirement to achieve the CyFun baseline level by January 1, 2030, and, in any case, the security obligations under the GDPR. The attack on Antwerp shows that the regulator will look back mercilessly at what was not properly addressed in advance. Legal preparations—from defining the scope and the incident response plan to supplier contracts—are therefore best done today, not on the morning of the incident.