Ten years after the adoption of the General Data Protection Regulation, an employer in Belgium must be able to demonstrate five things: a valid legal basis for each processing activity (consent is rarely sufficient), a retention policy for each category of HR data, a proportionate monitoring policy, a functioning procedure for access requests, and a departure procedure that closes a former employee\u2019s email account within one month. We will discuss these obligations based on the most recent decisions of the Data Protection Authority\u2019s Dispute Chamber and outline what employers must do in practice today.<\/p>\n\n\n\n
In short:<\/p>\n\n\n\n
The General Data Protection Regulation<\/a> (GDPR) was adopted on April 27, 2016, and has been directly applicable in all member states since May 25, 2018. In Belgium, it is supplemented by the Act of July 30, 2018, on the Protection of Individuals with Regard to the Processing of Personal Data<\/a>. You can find the general framework on our page about the data protection law<\/a>; this concerns only its application in the workplace.<\/p>\n\n\n\n According to Article 4(1) of the GDPR, personal data is any information relating to an identified or identifiable natural person. This definition is broad. It includes not only a name or address, but also a photograph, a professional email address, an IP address, login credentials, or an employee ID number. According to Article 4(2) of the GDPR, \u201cprocessing\u201d refers to virtually any operation performed on such data, from collection to erasure.<\/p>\n\n\n\n In the workplace, these two concepts constantly intersect. The employer collects data during the hiring process, maintains it for payroll purposes, supplements it during performance reviews and training, and monitors the use of company resources. In doing so, the employer is in a position of authority over an employee who depends on the employer. This hierarchical relationship explains why Article 88 of the GDPR allows for special national rules in the employment context, and why the Disputes Chamber holds the employer, as the data controller, to a stricter standard than a business would be held to in its dealings with a customer. According to Article 4(7) of the GDPR, a data controller is the party that determines the purposes and means of processing; in the employment relationship, this is almost always the employer.<\/p>\n\n\n\n It all starts with the principle of data minimization set forth in Article 5(1)(c) of the GDPR. A prospective employer may only request the data necessary to assess whether a candidate is suitable for the position. In the context of employment law, that principle is supplemented by Collective Bargaining Agreement No. 38 of December 6, 1983, regarding the recruitment and selection of employees<\/a>, which requires the employer to respect the applicant's privacy and to treat the information obtained as confidential.<\/p>\n\n\n\n A distinction must be made depending on the stage of the procedure. During the initial screening, limited information is sufficient. Only once a decision has been made and preparations for the new hire are underway do details about the candidate\u2019s family situation become relevant\u2014for example, for withholding tax or enrolling in insurance. Therefore, asking about a partner\u2019s occupation during a job interview is generally not justifiable. Employers should therefore periodically review their standard questionnaires and interview scripts in this regard.<\/p>\n\n\n\n When it comes to sensitive data, the bar is set higher. Article 9 of the GDPR generally prohibits the processing of data concerning health, trade union membership, ethnic origin, or sexual orientation, unless one of the exceptions applies, such as the need to comply with obligations under labor or social security law. Questions about a job applicant\u2019s health or pregnancy are therefore generally not permitted, unless the position involves specific risks. Since the Directive (EU) 2023\/970 on pay transparency<\/a> In addition, there will be a ban on asking job applicants about their current or previous salary.<\/p>\n\n\n\n That prohibition remains in effect after the employee starts work, and it also applies to information the employee discloses on his or her own initiative. In the Warning and Reprimand No. 113\/2021<\/a> In a decision dated October 11, 2021, the Dispute Resolution Chamber reprimanded a school because information about a teacher\u2019s health\u2014which he had shared in confidence with his principal\u2014had been disclosed to the school\u2019s governing body and other school administrations. The information had been provided within the context of a confidential relationship and was not to be shared beyond that context.<\/p>\n\n\n\n Criminal records are subject to their own set of rules. Article 10 of the GDPR subjects them to strict conditions, so that an employer cannot routinely require a criminal record check from every candidate. Only for certain positions, such as those in the security sector, does the law provide for specific requirements regarding criminal history.<\/p>\n\n\n\n Anyone wishing to conduct a background check must first determine whether the information can be obtained directly from the candidate. A reference check requires the applicant\u2019s specific and informed consent, and a refusal should not, in and of itself, lead to rejection. When it comes to social media, \u201cpublicly accessible\u201d does not mean \u201cfreely usable\u201d; we discussed the boundaries earlier in the blog post addressing the question of whether a Employers may screen online profiles during the job application process<\/a>.<\/p>\n\n\n\n Two practical points conclude this phase. Anyone who engages an external recruiter must determine in advance whether that recruiter is a processor (in which case a data processing agreement is required under Article 28 of the GDPR; see our page on the processing agreement<\/a>), an independent data controller, or a joint controller within the meaning of Article 26 of the GDPR. And the data of rejected candidates are, in principle, erased as soon as it is established that no employment contract will be concluded; longer retention in a candidate pool requires separate consent that cannot be inferred from participation in the selection process. The Dispute Resolution Chamber added the following on November 28, 2025, in the Decision No. 200\/2025<\/a> Furthermore, when a job applicant submits a request for access, they must be specifically informed of the source of their data, which data comes from which source, and in what form.<\/p>\n\n\n\n All processing must be based on one of the legal grounds set forth in Article 6 of the GDPR. In the employment relationship, these are primarily the performance of the employment contract (wages, work organization), legal obligations (social and tax law), and legitimate interests. Legitimate interest is the legal basis under which the employer must demonstrate a genuine and legitimate interest, prove that the processing is necessary for that purpose, and verify that the employee\u2019s rights do not outweigh those interests. This three-part test must be documented in advance and in writing; it must not be a catch-all category that the employer resorts to when a complaint is received.<\/p>\n\n\n\n Consent is at the bottom of the list. The Disputes Chamber has repeatedly ruled that, given the relationship of authority, an employee cannot, in principle, give free consent when the employer is the data controller. It did so, among other things, in the Order No. 35\/2024<\/a> dated February 20, 2024, and in the Decision No. 114\/2024<\/a> dated September 6, 2024, regarding time tracking using biometric data. According to that interpretation, consent is generally not a valid legal basis in the workplace. <\/p>\n\n\n\n It is true, however, that the Dispute Resolution Chamber in the Decision No. 72\/2020<\/a> In its ruling of November 9, 2020, the court did, however, accept that an employee could validly consent to the processing of information regarding his union membership, because such processing was carried out exclusively for his benefit and the employer derived no benefit from it. An employee can therefore, despite their subordinate position, freely consent when they have complete freedom to refuse and when refusing does not entail any direct or indirect disadvantage.<\/p>\n\n\n\n The latter is also legally defensible. Article 7 of the GDPR and Recital 43 do not rule out consent in an unequal relationship; they presume it to be non-free. This presumption can be rebutted. The problem lies in the evidence. According to Article 7(1) of the GDPR, the employer must be able to demonstrate that the consent was freely given, and that evidence is difficult to provide in an employment relationship once the processing also serves the employer\u2019s interests. In the 2020 case, the processing served only the employee; in the 2024 biometrics case, it served the employer. We therefore believe that this is defensible for processing that is exclusively for the benefit of the employee (a birthday gift, a voluntary union dues deduction), but that it does not provide a legal basis for control, monitoring, or access management. In those cases, the legitimate interest\u2014supported by a documented balancing test\u2014remains the only viable legal basis.<\/p>\n\n\n\n An employer may oversee the performance of the work. This right to monitor stems from the employer-employee relationship, but it is not unlimited. The employer must not base decisions on what a system is technically capable of, but rather on what the employer actually needs. Before implementing a monitoring measure, the employer must specify the objective being pursued, the data required to achieve it, whether a less intrusive measure would suffice, who will have access to the results, and how long they will be retained.<\/p>\n\n\n\n Geolocation illustrates this point. A GPS system in a company vehicle can be used for theft prevention, scheduling, or keeping customers informed. The Dispute Resolution Board accepted in the Decision No. 15\/2023<\/a> dated February 21, 2023, states that such objectives may be legitimate, but a system implemented for theft protection may not be used without further ado to monitor breaks or performance. For vehicles that are also used for personal purposes, a privacy mode or an option to disable tracking outside of working hours must prevent tracking during personal use. We analyzed a later decision on the same topic in the blog post addressing the question of whether a an employer may install a geolocation system in a company vehicle<\/a>.<\/p>\n\n\n\n Social media requires the same level of restraint. The Dispute Resolution Chamber accepted in its Decision Without Consequences No. 06\/2021<\/a> dated January 28, 2021, regarding an employer\u2019s monitoring of working hours and social media, which states that an employee\u2019s reasonable expectation of privacy diminishes to the extent that he or she voluntarily shares statements in the public sphere. This does not mean that publicly available information may be used for any purpose. Anyone who uses a screenshot or an online post in disciplinary proceedings is processing personal data and must, for that purpose, specify the purpose, limit the monitoring to what is relevant, and document why further verification was necessary. Occasionally reviewing a message brought to the employer\u2019s attention is different from systematically monitoring all employees; the more systematic the monitoring, the more difficult it is to justify.<\/p>\n\n\n\n Remote work doesn\u2019t change the rules, but it tempts people to resort to extreme measures. Systems that log keystrokes, automatically take screenshots, or track all digital activity are particularly intrusive and will be difficult to justify. Monitoring results or conducting limited checks on login times is generally the less intrusive alternative. Furthermore, when monitoring email and internet use, Collective Bargaining Agreement No. 81 of April 26, 2002<\/a> applies, with its own information and individualization procedure.<\/p>\n\n\n\n Can an employer require that the camera be turned on during a video conference? The employer may have a legitimate interest in doing so during a performance review or an interactive training session, but a general requirement for every online meeting is harder to justify than a specific rule tailored to each type of meeting. Can video calls be recorded? A recording permanently captures voices, images, statements, and shared documents and is therefore much more intrusive than the meeting itself. The argument that a recording \u201cmight be useful later\u201d is not sufficient. Participants must be explicitly informed in advance about the purpose, access, and retention period; a recording icon in the meeting application is insufficient for this purpose. The Dispute Resolution Chamber confirmed the importance of this transparency on May 12, 2026, in the Decision No. 102\/2026<\/a> regarding the recording and listening to of phone calls for quality control and training purposes.<\/p>\n\n\n\n Employees have all the rights set forth in Articles 15 through 22 of the GDPR. In HR practice, the right of access carries the most weight. An employee may ask what data about them is being processed, for what purposes, to whom it is disclosed, and how long it is retained, and they are entitled to a copy.<\/p>\n\n\n\n That copy pertains to the personal data, not every document in which it appears. The employer must take into account the rights and freedoms of others. A request for access therefore does not grant unlimited access to entire email inboxes, internal reports, or files that also contain third-party data or confidential business information. The Dispute Resolution Board ruled in the Decision No. 40\/2023<\/a> dated April 3, 2023, regarding a denial of access after the end of employment, and ruled in the same case that a functional email account managed by multiple employees may continue to exist after one of them leaves.<\/p>\n\n\n\n The deadline is strict. The employer must respond within one month; the employer may extend this deadline by two months if the complexity of the request or the number of requests warrants it, but must then inform the employee of the extension and the reasons for it within the first month. A request may not be left unaddressed by the supervisor or HR representative who receives it; this follows from the Decision No. 97\/2026<\/a> dated May 6, 2026, regarding an unanswered request for a copy of performance reviews. Not every request refers to the GDPR. An employee who simply asks what data is being kept about them is already exercising their right of access. HR and managers must recognize this and forward the request internally.<\/p>\n\n\n\n The right to rectification (Article 16 of the GDPR) is limited to factual information; a negative evaluation cannot be \u201ccorrected,\u201d but the employee may have his or her point of view added to the file. The right to erasure (Article 17 of the GDPR) is subject to statutory retention requirements and does not apply to data that remains necessary for legal proceedings. Data that may not be erased may therefore not be used for other purposes: the principle of purpose limitation continues to apply.<\/p>\n\n\n\n After an employee leaves, the employer continues to process a significant amount of personal data. Some of this data must be retained to comply with social security, tax, or accounting obligations; other data may be retained to defend against potential legal claims, as permitted by Article 17(3)(e) of the GDPR. However, this does not justify the indefinite retention of the entire personnel file. The employer must determine, on a category-by-category basis, how long and why the data will be retained, and who still has access to it.<\/p>\n\n\n\n The email account is the most sensitive component. An email address that includes an employee\u2019s first or last name constitutes personal data; in principle, third parties are not permitted to use that account. The Dispute Resolution Board has applied this rule since the Decision No. 64\/2020<\/a> dated September 29, 2020, regarding the decision not to close the email account after the end of a position\u2019s term: the mailbox is closed, a neutral automatic reply directs recipients to an alternative point of contact, and continuity is organized in a less disruptive manner. In principle, the period is one month; an extension to a maximum of three months requires an explicit balancing of interests. This policy was reiterated on April 23, 2026, in the Decision No. 86\/2026<\/a>.<\/p>\n\n\n\n On May 12, 2026, the most severe application to date took place. In the Decision No. 101\/2026<\/a> The Dispute Resolution Chamber ruled on the case of a self-employed consultant who, as a member of the \u201cextended workforce,\u201d had a professional email address provided by the company. The email account remained active after the collaboration ended. The Dispute Resolution Chamber held that an email account inevitably contains a mix of company information, employee data, private communications, and third-party data, and that continued processing after the employee\u2019s departure can only be based on a legitimate interest on a temporary basis. It ordered the company to take appropriate measures, grant access, delete the data in the mailbox, and hand over the access logs, and imposed fines of 160,860.55 EUR and 16,086.06 EUR. We discussed that decision in detail in the blog post addressing the question of whether the It is sufficient to deactivate a former employee's mailbox<\/a>; the answer was no; deactivating is not the same as deleting.<\/p>\n\n\n\n Here, too, a note of caution is in order. The one-month period is not specified in the GDPR; it is the Dispute Resolution Chamber\u2019s interpretation of the principle of storage limitation. However, it is a rule of practice. An employer wishing to justify a longer period could, in theory, do so with a documented balancing of interests, but the decision of May 12, 2026, shows that the Dispute Chamber interprets such justification strictly and that the cost of a failed attempt is high. The safest approach remains the handover before departure: the departing employee organizes their email inbox, deletes or moves personal messages, and transfers professional information to a colleague.<\/p>\n\n\n\n The GDPR applies equally to freelancers, independent consultants, temporary workers, and employees of service providers. A privacy notice written solely for employees does not cover their data processing, and anyone who processes personal data on behalf of the company needs a data processing agreement. The case of the consultant in Decision No. 101\/2026 demonstrates that the Dispute Resolution Chamber does not make that distinction.<\/p>\n\n\n\n The record of processing activities referred to in Article 30 of the GDPR must reflect the actual situation. A new HR tool, a new access control system, or a new form of monitoring is a reason to update the record and to determine the legal basis in advance. A company should not wait until a complaint or a request for access is received before beginning to search for a legal basis.<\/p>\n\n\n\n Enforcement is a real possibility. Article 83 of the GDPR allows for fines of up to 20 million EUR or 4 percent of global annual revenue. In the Decision No. 56\/2021<\/a> On April 26, 2021, the Dispute Resolution Chamber imposed a fine of 100,000 EUR on a financial institution because an employee had unlawfully accessed data in the National Bank\u2019s credit registry; the employer remained liable, even though the employee had acted in violation of internal instructions. Internal policies are therefore not sufficient. The employer must be able to demonstrate that access rights are restricted, logged, and periodically reviewed.<\/p>\n\n\n\n Employers and HR Departments<\/strong> It is best to draw up a checklist with five items. A legal basis for each processing activity, determined in advance and, in the case of a legitimate interest, weighed in writing. A retention policy that specifies a retention period and a legal basis for each category of HR data (job applications, employment contracts, payroll, performance reviews, disability, audit data), and that is also implemented in local files and shared folders. A control policy that specifies the purpose, data, access, and retention period for each tool, including a privacy mode for company vehicles and differentiated rules for cameras and recording during video calls. An internal procedure that identifies requests for access to data and responds to them within one month. And a departure procedure in which HR and IT work together to deactivate accounts, recover devices, and clear the email inbox within one month. If you\u2019re unsure whether your current IT policy and exit procedure meet these standards, that\u2019s the first thing we\u2019ll check for you; an employer who wants to address this systematically is best served by a lawyer specializing in GDPR\/AVG<\/a>.<\/p>\n\n\n\n For employees and former employees <\/strong>The focus is on rights. Anyone who wants to know what data the employer keeps does not need to submit a formal request citing the GDPR; a simple request for a copy is sufficient, and the employer must respond within one month. A former employee retains these rights as long as the employer continues to process their data and can therefore request access to information about what happened to their email account even after leaving the company. A refusal or failure to respond may be the subject of a complaint filed with the Data Protection Authority.<\/p>\n\n\n\n For freelancers and consultants <\/strong>Since the decision of May 12, 2026, contractors who provide an email address are entitled to the same protection as employees. It\u2019s a good idea to agree in writing at the start of the assignment on what will happen to the email account once the assignment ends.<\/p>\n\n\n\n An employer may process the personal data necessary to fulfill the employment contract (identity, wages, working hours), to comply with its legal obligations (social security, tax authorities), and to pursue a legitimate interest, such as the security of company assets. The employer may process sensitive data\u2014such as health information or union membership\u2014only when an exception under Article 9 of the GDPR applies. The employee\u2019s consent is rarely a valid legal basis.<\/p>\n\n\n\n No, not indefinitely. The Dispute Chamber of the Data Protection Authority expects the email account to be closed with a neutral automatic reply, and for the data it contains\u2014including the email address itself\u2014to be deleted after one month, in principle. An extension to three months is only possible following an explicit balancing of interests. Simply deactivating the mailbox is not sufficient; in May 2026, this resulted in fines totaling 176,946.61 EUR.<\/p>\n\n\n\n A general requirement for every online meeting is difficult to justify. An employer may, however, require the use of a camera when visual interaction is necessary, such as during a performance review, an interactive training session, or a workshop. In doing so, the employer must balance the legitimate interest against the employee\u2019s privacy, as the camera also captures the employee\u2019s home and household members. A differentiated policy based on the type of meeting is the most defensible approach.<\/p>\n\n\n\n Within one month of receipt. The employer may extend this period by two months if the request is complex or if there are a large number of requests, but must inform the employee of the extension and the reasons for it within the first month. The request does not need to refer to the GDPR; even a simple request for a copy of the data counts as a request for access and must be forwarded internally to the appropriate person for processing.<\/p>\n\n\n\n Ten years after the adoption of the GDPR, data protection in the workplace in Belgium is no longer just a matter of a privacy statement, but of demonstrable practices: a legal basis for each processing activity, a retention policy for each category, a proportionate audit policy, a functioning access procedure, and an exit procedure that clears the email inbox within one month. <\/p>\n\n\n\n ICT Rechtswijzer is the knowledge platform of the intellectual property, IT law, AI law, data protection, and media law department at Everest Advocaten, led by Joris Deene, Esq. Our attorneys assist employers in drafting their IT policies, data retention policies, and exit procedures, and represent employees and freelancers who wish to enforce their rights of access or erasure.<\/p>\n\n\n\nRecruitment and Selection: What Information Can an Employer Ask a Job Applicant For?<\/h3>\n\n\n\n
An employee's consent: rarely the solution, but not always out of the question<\/h3>\n\n\n\n
Supervision and monitoring: necessity determines the approach, not the technology<\/h3>\n\n\n\n
Employee Rights: Access Does Not Constitute a Right to the Entire Mailbox<\/h3>\n\n\n\n
End of the Employment Relationship: The Email Inbox Poses the Greatest Risk of Penalties<\/h3>\n\n\n\n
Freelancers, Processing Registry, and Enforcement<\/h3>\n\n\n\n
Specifically, what does this mean?<\/h3>\n\n\n\n
Frequently asked questions (FAQ)<\/h3>\n\n\n\n
What personal data may an employer process regarding its employees?<\/h4>\n\n\n\n
Can my employer continue to use my email account after I leave?<\/h4>\n\n\n\n
Can an employer require me to turn on my camera during every video conference?<\/h4>\n\n\n\n
How quickly must an employer respond to an employee's request to access personal information?<\/h4>\n\n\n\n
Conclusion<\/h3>\n\n\n\n
\n\n\n\n