Belgium Private Investigation Act: Practical Guide for Companies

Private investigation act belgium reforms are reshaping how companies in Belgium conduct surveillance, screen candidates, run internal investigations and collect evidence for transactions. The new Private Investigation Act (Wet tot regeling van de private opsporing / Loi réglementant la recherche privée) introduces a tighter framework around private investigation activities, corporate monitoring, background checks and evidence collection, and it arrives with an enforcement timeline that leaves limited room for delay. In-house counsel, HR leaders, compliance officers and M&A teams all have operational obligations to consider, from refreshed Data Protection Impact Assessments (DPIAs) to revised due diligence protocols. This guide sets out what changed, what you must do, and which compliance path your organisation should consider.

Quick summary, what the private investigation act belgium changes and the timeline

The Private Investigation Act regulates who may carry out private investigation activities in Belgium, what techniques are permitted, and under what conditions evidence may be gathered and used. In practical terms, it brings corporate surveillance, pre-employment screening, fraud investigations and transactional diligence more firmly within a licensing and proportionality framework, layered on top of existing data protection obligations under the GDPR. The Act replaces and modernises Belgium’s earlier regime governing private detectives.

The statute addresses a broad range of investigative conduct, including:

• Who may investigate. Controls on licensed private investigators and on companies commissioning investigative work, with authorisation and conduct requirements.
• Permitted techniques. Rules distinguishing lawful observation and record-gathering from intrusive or covert methods that require specific justification or are restricted outright.
• Evidence handling. Expectations around lawful collection, documentation and chain of custody, which bear directly on admissibility.
• Interaction with privacy law. Alignment with GDPR lawful-basis, proportionality and DPIA requirements, and with Belgian Data Protection Authority guidance.

Enforcement and administration responsibilities sit with the relevant Belgian authorities, with the Federal Public Service (FPS) Justice providing the administering and procedural context and the Belgian Data Protection Authority leading on the data protection dimension. Companies should confirm the exact effective date and any transitional provisions against the official publication in the Belgian Official Journal (Belgisch Staatsblad / Moniteur belge) via e-Justice. Where final statutory text or a specific transitional window is not yet confirmed in the official entry, treat those details as provisional and verify directly before relying on them. The practical message is unchanged: begin remediation early rather than waiting for the last enforcement date.

Enforcement is widely expected to focus first on the most intrusive and least-documented monitoring practices, which means organisations running covert surveillance or undocumented screening should treat those as immediate priorities.

Employee monitoring and privacy, what HR must change

Employee monitoring Belgium practices are where most companies will feel the Private Investigation Act most acutely. The Act does not displace the GDPR; it operates alongside it. That means any monitoring of staff must rest on a valid lawful basis, be proportionate, be transparent, and, where high risk is involved, be assessed through a DPIA before deployment. The Belgian Data Protection Authority and European Data Protection Board have both made clear that workplace monitoring is a high-scrutiny area, and that employee consent is rarely a reliable lawful basis given the imbalance of power in the employment relationship.

In most cases, employers will rely on legitimate interest rather than consent, which obliges the organisation to document a balancing test, apply data minimisation, and provide clear notice. In Belgium, certain forms of monitoring are also governed by sectoral collective bargaining agreements negotiated within the National Labour Council (for example, those addressing camera surveillance in the workplace and the monitoring of electronic online communications data). Specific categories of monitoring carry additional requirements:

• CCTV and physical surveillance. Must be justified, signposted, retention-limited and proportionate to the stated purpose, and compliant with applicable camera-surveillance rules.
• Email, internet and network monitoring. Permissible only with a demonstrable purpose, minimised scope, transparency and, typically, a DPIA, and within the limits set by applicable collective agreements.
• Biometric monitoring. Treated as special-category processing, demanding a stronger legal footing and heightened safeguards.
• Remote and work-from-home monitoring. Subject to the same proportionality and transparency tests; intrusive home monitoring is particularly difficult to justify.

Collective consultation matters as much as the legal basis. Where a works council or trade union representation exists, monitoring technologies and policies typically require information and consultation before implementation. Skipping this step undermines both the lawfulness of the processing and the defensibility of any evidence later derived from it.

Pre-implementation checklist for HR and IT

• Map current monitoring. Produce a full inventory of every system that captures employee data, cameras, email filters, endpoint agents, access logs, GPS.
• Confirm a lawful basis. Document legitimate interest balancing tests; avoid relying on consent where power imbalance applies.
• Run or refresh DPIAs. Complete a DPIA before deploying or continuing any high-risk monitoring.
• Update notices. Ensure employees receive clear, specific privacy information about what is monitored and why.
• Consult representatives. Engage the works council or union before implementing or changing monitoring tools.
• Set retention limits. Define and enforce how long monitoring data is kept and when it is deleted.
• Review access controls. Restrict who can view monitoring outputs and log access.

Example policy language

Clear, plain-language policy wording reduces disputes and strengthens defensibility. A monitoring clause should state the purpose, scope, lawful basis, retention period and employee rights, for example, setting out that email and network use may be monitored to protect information security and detect fraud, that monitoring is proportionate and logged, that data is retained only for a defined period, and that employees may exercise their data subject rights through a named contact. Policy text should be reviewed by Belgium-qualified counsel before adoption.

DPIA and vendor contracts

Monitoring rarely happens in-house alone. Surveillance software, HR screening platforms and forensic tools usually involve processors, which brings vendor contracts into scope. Each DPIA should assess not only the internal processing but the supplier’s role, security measures and sub-processors. Contracts must contain GDPR-compliant processing clauses (consistent with Article 28 of the GDPR), security commitments, breach notification duties, audit rights and clear instructions limiting the vendor to the agreed purpose. A standardised DPIA template should be used to ensure consistency across the organisation.

Commentary: On the HR side, a common failure point is not the technology itself but the absence of a documented balancing test and timely works council consultation. Monitoring maintained without those records is often the easiest target for both regulators and litigation opponents.

Background checks and pre-employment screening

Background checks Belgium practices sit within the Private Investigation Act’s reach, because pre-employment vetting can amount to an investigation into an individual. Companies must distinguish between checks that are routinely permissible and those that are restricted. Verification of qualifications, professional references and publicly available professional information is generally defensible where it is relevant to the role and proportionate. Criminal record extracts (uittreksel uit het strafregister / extrait de casier judiciaire), by contrast, are tightly controlled and are only appropriate where the role genuinely justifies them, for example, positions involving significant trust, safety responsibilities or regulated functions.

Core rules for lawful screening include:

• Relevance and proportionality. Only collect information that is necessary for the specific role.
• Restricted criminal checks. Limit criminal record requests to roles that genuinely require them under applicable rules.
• Transparent basis. Inform candidates what checks will be carried out and why.
• Retention limits. Hold screening data only as long as needed; delete unsuccessful-candidate data promptly.
• Record of processing. Maintain documentation of screening activities under the GDPR accountability principle.

Practical templates and red flags

Standardised documentation reduces risk. A compliant screening process uses a clear candidate information notice, a defined checklist of permitted checks per role category, and a documented retention schedule. Red flags that should trigger legal review include: blanket criminal checks applied to all roles regardless of relevance, open-ended social media surveillance of candidates, reliance on undisclosed third-party investigators, and retention of screening data with no deletion trigger.

Corporate investigations and evidence collection

Corporate investigations Belgium teams, whether handling suspected fraud, misconduct or whistleblower reports, must operate with heightened care about method and documentation. The Private Investigation Act reinforces the line between lawful investigative activity and impermissible intrusion, and it connects directly to the investigator licensing and authorisation framework. Internal investigations that stray into covert surveillance, pretexting or unauthorised access to personal data risk not only regulatory exposure but the exclusion of the resulting evidence.

Admissibility of evidence in Belgian courts depends heavily on how it was gathered. Evidence collected unlawfully, without a proper basis, or without a reliable chain of custody is vulnerable to challenge. Legal commentary on privacy and investigations underscores that lawful collection and robust documentation materially strengthen the evidentiary position, while covert methods face a high justification threshold. Companies should assume that any evidence they may later need to rely on in litigation or disciplinary proceedings must survive scrutiny of both the Act and the GDPR.

Forensic collection checklist

• Define scope and authority. Document who authorised the investigation, its purpose and its boundaries before collecting anything.
• Prefer lawful, transparent methods. Use open investigative techniques wherever possible; treat covert methods as exceptional and justified.
• Establish chain of custody. Record how each item was collected, by whom, when and how it is stored.
• Protect personal data. Apply GDPR principles to investigation data; minimise and secure it.
• Engage licensed investigators correctly. Confirm any external investigators are authorised and contractually bound to lawful methods.
• Preserve privilege. Structure legal-review workstreams to protect privilege where applicable.

M&A due diligence, practical implications for buyers and sellers

M&A due diligence Belgium processes are directly affected by the Private Investigation Act, because diligence frequently involves investigating a target’s people, contracts and conduct. Buyers can no longer assume that any investigative method is fair game. Covert investigation of a target’s management or workforce, or acquisition of personal data gathered unlawfully by the seller, creates liability that can follow the buyer post-closing. Sellers, in turn, must be able to warrant that their own monitoring, screening and investigation practices were lawful.

Key adjustments to the deal process include:

• Scope diligence lawfully. Restrict pre-deal investigation to lawful, proportionate methods; avoid covert surveillance of target personnel.
• Request compliance evidence. Ask for DPIAs, monitoring policies, consultation records and screening documentation as part of the data room.
• Check data transfers. Verify that personal data shared in diligence is transferred on a lawful basis, including any cross-border transfer under the GDPR.
• Add targeted warranties. Seek representations that the target’s investigations, monitoring and screening complied with the Act and data protection law.
• Use indemnities and escrow. Where compliance gaps appear, address them through specific indemnities or escrow rather than ignoring them.
• Plan post-closing remediation. Build a remediation roadmap for any non-compliant practices inherited at completion.

For buyers, the practical checklist is to confirm what can and cannot be investigated before signing, to secure seller warranties on lawful investigations and monitoring, to validate data protection compliance in the data room, and to protect against latent liability through reps, indemnities and escrow. For sellers, the priority is to prepare clean documentation in advance, policies, DPIAs, consultation records and screening logs, so that warranties can be given confidently and the transaction is not delayed by avoidable diligence findings.

Commentary: In transactions, the sharpest practical effect of the Act is on warranties and escrow. The likely result is that buyers will insist on explicit representations about lawful investigations and monitoring, and will price unresolved compliance gaps into escrow. Sellers who prepare documentation early typically negotiate from a stronger position and avoid deal friction.

Enforcement, penalties and commercial liability

Enforcement of the private investigation act belgium framework involves the competent Belgian authorities, with the FPS Justice providing the administering and procedural context and the Belgian Data Protection Authority handling the data protection dimension. Non-compliance carries several layers of exposure:

• Administrative and criminal sanctions. Penalties and fines for breaches of the investigative framework and, separately, for data protection failures under the GDPR.
• Civil liability. Claims from employees, candidates or counterparties whose rights were infringed by unlawful monitoring or investigation.
• Evidentiary loss. Potential exclusion of unlawfully obtained evidence, undermining disciplinary action, litigation or deal protection.
• Reputational risk. Damage from publicised regulatory action, particularly where sensitive employee data is involved.

Confirm the specific sanctions, thresholds and procedural routes against the official statutory text via e-Justice once the final Act is published; where those details remain provisional, verify before relying on any figure. GDPR fines are, separately, subject to the maximum thresholds set by Regulation (EU) 2016/679.

Implementation options and comparison table, choosing your compliance path

Every company must now decide how to realign its practices. There are two credible strategies. Most organisations will land on one of the two paths below. Use the table to compare them on the dimensions that matter, then apply the decision framework.

Our recommendation and decision framework:

• Choose Option A (Risk-Minimiser) when you operate in a regulated sector, handle sensitive personal data, face high litigation or regulatory risk, or are about to enter a sensitive M&A transaction. For these organisations, the conservative path is often the right call, the cost of a fine, an excluded piece of evidence, or a stalled deal can far outweigh the short-term operational constraint.
• Choose Option B (Pragmatic) when monitoring is genuinely essential for security or fraud prevention, business continuity is critical, and you can implement robust DPIAs, technical safeguards and documentation quickly. This path is defensible, but only if the record-keeping is genuinely rigorous.

If you are unsure, default to Option A for any system you cannot currently document and defend, and apply Option B only to monitoring that already has a completed DPIA, a tested lawful basis and works council sign-off.

Timeline and milestones for each option

For Option A, plan a 3–6 month programme: audit (weeks 1–4), high-risk suspension and interim measures (weeks 2–6), works council consultation (weeks 4–10), policy and contract overhaul (weeks 8–16), and full redeployment under compliant terms (weeks 16–24). For Option B, compress to 30–90 days: DPIA of active systems (weeks 1–4), vendor contract updates (weeks 2–6), targeted notices and training (weeks 4–8), and a documented review checkpoint (weeks 8–12).

Sample board resolution language to adopt the chosen path

Board minutes should record the decision, its rationale and accountability. Indicative wording: “The Board, having reviewed the obligations arising under the Private Investigation Act and applicable data protection law, resolves to adopt the [Risk-Minimiser / Pragmatic] compliance path, approves the associated budget and timeline, and delegates implementation and reporting to [named officer], with a compliance review to be presented to the Board within [period].” Final wording should be confirmed by Belgium-qualified counsel.

Contract clauses to add for sellers and buyers

Transaction documents should include a warranty that the target’s investigations, monitoring and screening complied with the Act and data protection law; an indemnity covering losses arising from pre-closing non-compliance; a data protection compliance representation covering DPIAs and consultation records; and, where gaps exist, an escrow mechanism tied to defined remediation milestones.

Immediate checklist, 90-day action plan for companies

1. Days 1–15: Audit all monitoring, screening and investigation activities and identify high-risk practices.
2. Days 10–30: Pause or mitigate the highest-risk monitoring; begin or refresh DPIAs on active systems.
3. Days 20–45: Update monitoring and screening policies and employee privacy notices.
4. Days 30–60: Consult the works council or union on monitoring tools and policy changes.
5. Days 40–70: Amend vendor and processor contracts to meet GDPR and Act requirements.
6. Days 50–80: Train HR, IT and investigation teams on lawful methods and evidence handling.
7. Days 60–90: Update the M&A diligence playbook, warranty templates and escrow approach; engage local counsel to validate the programme.

Resources and templates

The following assets support implementation. Where you do not have a current in-house version, ask Belgium-qualified counsel to prepare one tailored to your organisation:

• Employee monitoring DPIA template (Belgium).
• Employee monitoring policy and notice sample.
• M&A vendor/seller warranty clause on lawful investigations.
• 90-day compliance checklist.

Conclusion and next steps

The private investigation act belgium reforms call for action, not observation. Companies should audit their monitoring, screening and investigation practices now, document a lawful basis for everything they intend to keep, complete DPIAs, consult employee representatives, and align M&A warranties and escrow to the new framework. For most regulated and transaction-exposed organisations, the Risk-Minimiser path is the safer choice; for genuinely monitoring-dependent operations with rigorous documentation, the Pragmatic path is defensible. Either way, the 90-day plan above provides a workable route to compliance. To validate your chosen path and adapt these templates to your business, consult a Belgium-qualified corporate lawyer.

Sources

1. Belgian Official Journal / e-Justice (Belgisch Staatsblad / Moniteur belge)
2. Belgian Data Protection Authority
3. EUR-Lex, Regulation (EU) 2016/679 (GDPR)
4. Federal Public Service (FPS) Justice, Belgium
5. European Data Protection Board (EDPB)