Privacy, GDPR and cookies: what do you need to have in order?.

Details

• Source (Belgian Data Protection Authority – Cookies and other tracking technologies): https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/cookies — last update on the source page: 17 November 2023
• Source (UNIZO – Privacy and GDPR): https://www.unizo.be/ondernemersgids/juridisch/privacy-gdpr/privacy-en-gdpr — last update on the source page: 13 July 2026

Who is this for?

For every business that processes personal data — and that is essentially every business: a customer database, a newsletter, suppliers, staff, a website with analytics. This page bundles what you at a minimum need to have in order for GDPR and cookies, with the Belgian rules and the official checklists.

Part 1 — GDPR: four things you definitely need to arrange

1) Keep a processing register

Every business must keep a processing register. At a minimum, record:

• Which data you process (customers, suppliers, staff, website visitors, …)
• For what purpose and on what legal basis. Consent is only one possible basis. Data that is necessary to perform a contract, or that you can justify under a legitimate interest, may be processed on that basis.
• How long you keep the data. Never longer than strictly necessary for the purpose you defined above.
• To whom you disclose the data.

The Belgian Data Protection Authority provides free Excel templates for this, downloadable without any membership:

• Register template — simple version (controller, .xlsx) — start here if you decide why and how data is processed (the usual case for your own business).
• Register template — simple version (processor, .xlsx) — if you process data on behalf of a client (e.g., a freelance developer, a virtual assistant).
• Register template — extended version (.xlsx) — more columns, for those with many or sensitive processing operations.

The register must be in writing (electronic is fine), but not in paper and electronic form at the same time. Update it when your activities change, and keep it for up to 5 years after a processing operation ends — the DPA can still ask to see it afterwards.

Note: these templates are in Dutch and French only.

2) Be able to comply with data subject rights

Anyone whose data you process must be able to exercise their rights easily: access, rectification, erasure, objection, withdrawal of consent. Make sure there is a clear contact point and that you know internally where which data is stored. An overview of these rights is available on the Belgian Data Protection Authority (DPA) website.

3) Publish a privacy notice

All information about which data you process, the legal bases and the retention periods belongs in a privacy notice that is:

• concise
• transparent about what happens with the data
• understandable (clear, simple language — especially if the information is intended for children)
• easily accessible

You can work in layers: a short notice that links to a more detailed privacy policy on your website.

4) Conclude data processing agreements

If a third party processes data on your behalf — an IT partner, accountant, payroll provider, mailing tool — you need a data processing agreement.

Part 2 — Cookies and trackers

What exactly does cookie legislation cover?

Not only cookies. The rules apply to storing information or gaining access to information already stored on the user’s device. Local storage, session storage, pixels, beacons and other trackers are also covered.

Cookies can be distinguished in three ways:

• By purpose: technical/login, analytics (audience measurement), marketing & profiling, authentication, security, load balancing, interface personalisation, media player.
• By domain: first-party (set by your own domain) versus third-party (set by another domain — social plugins, ads, embeds). Third-party cookies allow those third parties to track behaviour across different websites and build profiles.
• By lifespan: session cookies (deleted when the browser is closed) versus persistent cookies (kept until an expiry date).

When do you need consent?

Always — except for strictly necessary cookies. There are two types:

1. Strictly necessary functional cookies, needed to provide a service the user explicitly requested (language choice, cookie preferences, shopping cart contents, security for a banking app).
2. Strictly necessary technical cookies, needed to transmit a communication over an electronic communications network (e.g., session cookies for load balancing).

Concrete examples the Belgian DPA lists as exempt: cookies for multi-step forms or a shopping cart, authentication cookies for the duration of a session, user-centric security cookies, session cookies from a media player, load-balancing session cookies, cookies that remember cookie preferences (in principle max. 6 months), and cookies for language preference (for the duration of a session or slightly longer).

Even for these exempt cookies, you must inform the user clearly and accurately.

Note — analytics is not an exception. The Belgian DPA is explicit: cookies for audience measurement (statistical or analytics cookies) require consent, even if they are first-party cookies. Counting visitors is not a service the visitor explicitly requested. Some regulators in other member states are more lenient, but in Belgium this is the line. If you use Google Analytics or a similar tool, you must therefore place it behind the cookie banner.

When is consent valid?

Consent must meet the GDPR conditions: prior, freely given, specific, informed, active and unambiguous — and withdrawable.

Prior. No non-essential cookie may be set or read before consent.

Active and unambiguous. A positive action: clicking a button or link. The following are not valid:

• a pre-ticked box the user must untick (opt-out)
• continuing to browse the site
• accepting the general terms and conditions
• the user’s browser settings

Informed. Before consent, provide precise information about the controller, the purposes, the data collected and the cookie lifespan, plus any automated decision-making and the data subject’s rights (including withdrawal). In plain language, in the language of your target audience.

Work in layers:

• First layer (the banner): the purposes briefly and clearly; the identity of who sets the cookies (including, where applicable, the number of partners and a link to the full list per category); how to accept or refuse; the consequences of each choice; the right to withdraw and how.
• Lower layer: the full list of cookies used per category, with their specific purpose, duration and recipients.

Freely given. The user must be able to refuse without restriction, pressure or detriment, and must still be able to use the service afterwards. This is why cookie walls are not allowed. The design of your banner can also undermine free choice:

• an “accept all” button without, on the same layer, a “reject all non-essential cookies” button
• misleading design (dark patterns) via colour, font size or placement

Specific. Consent applies per well-defined processing operation. “All or nothing” is not enough. In practice: a first layer with the categories plus “accept all” and “reject all”, and a clear link to a second layer with granular choices per category and, where applicable, per partner. The Belgian DPA considers it appropriate to offer, in a further layer, a choice per cookie as well — which implies each cookie serves only one purpose.

Withdrawable. Withdrawing consent must be as easy as giving it, and the user must be informed of this when consent is requested. For example, provide a floating button or a link in the footer of each page that brings users back to the cookie settings. Withdrawal must also actually have an effect: delete or neutralise cookies (e.g., a Set-Cookie with the same path and domain and a negative lifespan).

Cookie retention periods

Cookies and the information stored in them may not be kept longer than necessary for the purpose. An indefinite retention period is therefore not allowed. If timely deletion is not possible, your cookie policy should explain how the visitor can delete them themselves.

An exempt cookie must have a lifespan that is directly linked to its purpose and expires as soon as it is no longer needed — often at the end of the browser session, sometimes slightly longer (for example, a shopping cart may remain for a few hours). For cookies that remember cookie preferences, the Belgian DPA considers 6 months in principle reasonable.

Your cookie policy

If you place or read cookies or trackers, you must publish a cookie policy on your website or app. This document includes at least:

• identity and contact details of the controller (and, where applicable, of your DPO)
• identification of the cookies (types): name, domain and path
• the purpose(s) of each cookie (type)
• the cookie lifespan
• whether third parties have access, who those recipients are, and information about any transfers to third countries (including the safeguards in place and how the data subject can obtain a copy)
• how the data subject can delete cookies that were set
• the legal basis (Art. 6 GDPR): consent for non-essential cookies; for essential cookies another basis may apply, such as legitimate interest
• the retention period for data collected via cookies
• the data subject’s rights, including the right to withdraw consent

Accountability

You must be able to demonstrate that consent was obtained lawfully. To do so:

• keep track of how your consent mechanism (the banner) has been adjusted over time
• keep previous versions of your cookie policy
• give your cookie policy a date and a version number

This is not theoretical: the Belgian DPA has already issued a fine of €15,000 to a website whose cookie policy was not in order, among other things because consent was not requested.

Part 3 — Related situations

Advertising by email

General marketing email campaigns are in principle prohibited without prior consent from the recipient. Exception: existing customers. In that case it may be done without prior consent, provided that:

• the advertising concerns similar products to what that customer previously purchased
• you include an unsubscribe option in every email

Purely informational emails (e.g., a manual sent to someone who bought a product) do not fall under these strict rules.

Buying email addresses from a direct marketing agency

• Make sure the agency collected the necessary consents, and include that explicitly in the purchase agreement.
• Because you did not obtain the data directly from the data subject, you must inform them at the first contact: where you got the data from, which data, for what purpose, how long you keep it and what rights they have.
• When transferring to third parties, double opt-in is required: after sign-up, a confirmation email must clearly state that the data will be transferred and for what.
• Documentation duty: keep the content of the consent statement, the registration time and IP address, the content of the confirmation email and the time of confirmation.
• An old opt-in remains valid if it meets current requirements; if not, you must request consent again.

Asking customers for their ID card

Only allowed if it is necessary, and you are legally obliged to do so or the customer freely consents. “Freely” means the customer must still be able to use the service if they refuse. If a visual check is sufficient, you may not take a copy or read the card electronically.

CCTV cameras in your business

A shop is a “closed place accessible to the public”. There are three obligations:

1. Declaration to the police via www.aangiftecamera.be (an older declaration with the former Privacy Commission had to be resubmitted).
2. Place the legal pictogram clearly visible, before the entrance.
3. Keep a register of image processing activities, available upon request by the Belgian DPA and the police.

The camera may not be aimed at the public road. Covert camera use is prohibited. You may not share footage of (suspected) shoplifters — provide it to the police. If you also film employees for security, protection of goods or work monitoring, CAO No. 68 also applies.

Checklist: are you compliant?

Tools & templates

Free and public (Belgian Data Protection Authority)

Most of these documents are published in Dutch and French only.

• DPA Toolbox — hub page with all the templates below
• Register of processing activities — simple version, controller (.xlsx)
• Register — simple version, processor (.xlsx)
• Register — extended version (.xlsx)
• 13-step plan (PDF) — what to put in order, step by step
• FAQ brochure for SMEs (PDF)
• Cookie checklist (PDF)
• DPA – cookies theme

UNIZO members only

The UNIZO GDPR tool and templates (model privacy notice concise and extended NL/EN, model disclaimer and privacy statement for website, model data processing agreement, template register of processing activities, model response to the right of access, model opt-out notice emails, model permission for image use) sit behind a login and are available to UNIZO members only. If you are not a member, use the DPA templates above — note that the UNIZO privacy notice is the one model that does exist in English.

Other

• Childcare: specific tools (privacy notice, processing register, consent form for images, processing agreement) via Opgroeien.

Sources

• Belgian Data Protection Authority – Cookies and other tracking technologies: https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/cookies
• UNIZO Entrepreneurs’ Guide – Privacy and GDPR: https://www.unizo.be/ondernemersgids/juridisch/privacy-gdpr/privacy-en-gdpr