GDPR software for a Belgian organisation should help the people responsible for processing keep records, decisions and responses consistent across the languages and entities they actually serve. It need not generate every document in both French and Dutch for every Belgian business, and EU hosting alone does not settle all transfer or security questions. The buyer’s task is to test one representative activity, one rights request and one supplier change using the languages required for those audiences. This guide addresses that practical procurement decision in the Belgian APD/GBA context. It does not rank products by unsupported prices, assume a universal staff-size threshold or promise that a licence prevents a fine.
Belgium’s Data Protection Authority is the Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA). Its register guidance explains that a record of processing activities must be available on request under Article 30(4) GDPR. That is a reason to keep a readable record, not evidence that the register is always the first item demanded in every inspection. For the broader EU baseline, the GDPR ROPA guide covers the legal record.
Map the Belgian organisation before comparing tools
List each controller or processor entity, the people it serves and the languages in which it communicates. A Brussels office, a Dutch-speaking customer base and a German-speaking partner may have different communication needs. Article 12 GDPR requires concise, transparent and intelligible information in clear and plain language. For cookies, the APD’s guidance says information should be understandable to the target audience and gives French or Dutch for a site aimed at those audiences. Employment-document language rules can depend on the region and employee; an APD opinion on workplace documents discusses that context. Do not convert those specific rules into a blanket obligation to produce every internal ROPA entry, notice and contract bilingually.
A practical language inventory has four columns: the audience, document or interface, governing context, and person who checks the version. For a website offered in Dutch and French, test both consent notices and withdrawal routes. For employee information, check the establishment and applicable employment-language requirements. For an internal register, ask who will maintain it and who must understand an export. Where translations are useful, the tool should preserve one underlying decision and show who approved each language version. A machine-generated translation that silently changes the purpose or retention period can be worse than a controlled single-language working document with an approved translation when needed.
Determine the buyer’s role too. A Belgian SaaS firm may be controller for its staff and marketing data and processor for client data. A Belgian subsidiary may share systems with a group controller while keeping local responsibilities. Software must represent those roles and access boundaries rather than copy the same questionnaire across entities. A cross-border group may compare its Belgian trial with the separate France and Netherlands buying guides, while keeping the Belgian audience and authority questions here. The controller-versus-processor guide helps the team identify decisions that need legal review before they become fields in the product.
Use the APD/GBA register test
Article 30(1) sets the controller record’s fields: identities and contacts, purposes, categories of people and personal data, categories of recipients, transfers and safeguards, envisaged erasure periods where possible, and a general description of security measures where possible. Article 30(2) defines a different processor record organised by controller client and categories of processing. The GBA’s field explanation notes that legal basis can be an additional useful field; it is not an express field in Article 30(1). Test whether a candidate labels statutory requirements and extra workflow fields accurately. A system that marks every record “complete” after a legal basis is selected may still be missing a statutory category of recipients.
The exception for organisations with fewer than 250 employees is limited. It does not cover a processing activity that is non-occasional, poses the statutory risk to individuals, or involves Article 9 or Article 10 data. The GBA explains the exception using routine customer, HR and supplier activity as examples. Ask the tool to record the result per activity, including which trigger defeats the exception. Do not buy or reject a platform merely because your workforce falls within a marketing category such as “SME”. A small Belgian services firm may still need separate controller and processor records.
Create a fictional subscription service with a Brussels office and two sales teams. The service handles customer support in Dutch and French, uses an external host and may receive support from another country. Have each candidate enter the activity, identify the controller, record recipients, test the transfer question and export the register. Change the host in a second round. Can the tool preserve the old state, show who approved the new recipient and leave an unknown support location as an open question? A carefully managed spreadsheet may pass this test. A platform does not automatically pass because it has a prefilled “Belgium” template. The ROPA software buying guide gives a deeper tool-specific trial.
Rights requests need a language and deadline workflow
Have a Dutch-speaking customer send an access request to ordinary customer support, then a French-speaking employee send a separate request about personnel data. The request need not arrive through the vendor’s portal to be recognised. Under Article 12(3), the controller must inform a person of action taken without undue delay and at the latest within one month of receipt. A necessary extension of up to two further months depends on complexity or number of requests, with notice and reasons within the first month. If it does not act, Article 12(4) requires reasons without delay and no later than one month, plus complaint and judicial-remedy information. Software should preserve the actual receipt date, route, language, decisions and sent response.
The team must assess identity and third-party information proportionately. A request from a known account holder should not automatically demand a full identity-card copy. The final EDPB access guidance explains that a promptly requested, necessary identity check can suspend the response period until needed information arrives when there is uncertainty about identity; it is not a routine new one-month clock. A candidate should distinguish that situation from a complexity extension and keep the reasoning. The DSAR software comparison provides a wider workflow test, while the Belgian exercise adds audience-appropriate communication.
Run a refusal scenario too. If the organisation cannot act on part of the request, the response needs the Article 12(4) reasons and remedies, not merely a closed ticket. Test a partial answer with data from two systems, one of which has not replied. A bilingual interface does not solve the substantive decision, but it may help staff send consistent explanations to the actual person. The buyer should be able to view the version sent and the source records that support it. If the product sends an automated generic refusal to both people, it has failed the trial.
Advertising and the IAB Europe decision: use the precise history
The Belgian authority’s 2022 IAB Europe decision concerned the Transparency and Consent Framework, or TCF. It was appealed. In 2024 the Court of Justice ruled on the TC String and roles within the framework. The APD/GBA’s account of the 14 May 2025 Market Court judgment states that the original 2022 decision was annulled on procedural grounds, while the court confirmed the EUR 250,000 fine and key reasoning about the TC String and IAB Europe’s role within TCF. The court did not adopt the authority’s broader conclusion about processing occurring wholly within OpenRTB. Do not repeat the original 2022 action as if no appeal or later distinction existed.
That decision matters to an organisation using programmatic advertising, not to every Belgian buyer of a ROPA tool. If the fictional service runs a consent-based ad stack, add a separate test: can the CMP record the choices shown, rejection, withdrawal and partner disclosure, and can the team explain how those choices reach relevant vendors? A general privacy platform may track assessments but may not control a website banner. A CMP may manage choices but not the Article 30 record or rights cases. The CMP comparison helps define the technical trial; the consent-management guide explains the legal decision. Neither a software purchase nor the IAB fine proves the buyer’s own consent design is compliant.
Keep the case in its context when estimating risk. It is a regulator and court record about a particular framework, not a tariff for Belgian SMEs. Do not call the annual licence “cheap insurance” against a fine. The useful question is whether your advertising implementation actually uses TCF or similar sharing and whether the product retains evidence of the choices and roles involved. A firm with no ad-tech stack should spend its trial time on its own material activities instead.
Compare categories and evidence, not invented prices
A maintained spreadsheet plus a request log may work for a small organisation with few stable activities and a named owner. A privacy platform may help when the same activities must connect to processors, DPIAs and rights requests across teams. A CMP is a separate technical choice for websites and apps. A group GRC system may coordinate controls across entities, but needs the exact Article 30 data and local language outputs that your team has defined. Compare each category against the same fictional case. A general GDPR software comparison can orient research; do not treat its brand order as tested evidence for this Belgian buyer.
Suppliers including Dastra, OneTrust and TrustArc describe broad privacy products. Cookiebot describes consent-management services. These first-party pages establish advertised categories, not that a specific package produces correct French and Dutch notices, hosts exclusively in the EU, satisfies Belgian employment-language law or exports all records after cancellation. Ask for a demonstration and current contract. Remove any claimed vendor price from the decision until you have comparable written offers.
Create one quote sheet: number of entities, users, processing activities, requests, languages, websites, modules, data migration, support, storage and exit export. Request the same configuration from every candidate. Add staff time for inventory, review, translation approval, training and test responses. A GDPR software cost guide can supply cost categories, but public ranges do not establish a current price for a Belgian organisation. A cheaper licence can require more internal configuration; a wider platform can be wasteful when most modules are unused. Compare total work and proof quality rather than a per-employee slogan.
Security, hosting and supplier exit
Ask where data is stored, where support staff can access it, which subprocessors are used, and how the company will be informed of changes. Hosting inside the EU does not by itself exclude a third-country access path; a provider outside the EU is not automatically prohibited. Assess actual transfers under Chapter V GDPR and the technical and contractual safeguards. Under Article 28, a processor relationship must be governed by a written contract, including electronic form, or another binding Union or Member State legal act with the required content. The contract or act needs instructions, confidentiality, security, subprocessor arrangements, assistance and exit terms. Attaching a generic DPA file is not a legal verdict; the Article 28 guide explains the clauses to review.
The platform will likely contain employee names, rights requests, incident reports and sometimes sensitive free text. Ask the vendor to demonstrate role separation, audit logs, account revocation and restoration from backup on fictional data. A risk-based security review is more useful than an unverified claim of certification. If a breach of personal data occurs, Article 33 requires its documentation; notification to the authority is without undue delay and, where feasible, within 72 hours of awareness unless risk to people is unlikely, with reasons for later notification. Communication to individuals under Article 34 is a separate high-risk assessment. Do not assume every ordinary software outage is a personal-data breach.
Before signing, export the register, request history, versions, attachments and the mapping between entities in a readable format. Ask how the supplier will, at the controller’s choice, return or delete the hosted personal data on exit and delete its existing copies, including after a return, unless Union or Member State law binding the processor requires storage. Ask what backup schedule governs technical removal. Test the export with someone who did not configure the account. If they cannot reconstruct the Belgian entity’s decisions in the right language and date, the exit promise is incomplete. Record the chosen scope and unresolved issues before procurement approval.
Questions from Belgian buyers
Must every Belgian GDPR document be bilingual?
No universal GDPR rule says every register, notice and contract must exist in both French and Dutch. Article 12 requires intelligible communication. The audience, Belgian regional employment-language rules and the channel determine the needed language. Test the versions actually required for your customers and workforce, including any German-speaking audience where relevant.
Is a ROPA mandatory below 250 employees?
The under-250 exception is activity-specific and does not cover non-occasional processing, the statutory risk trigger or Article 9/10 data. The GBA explains routine customer and HR activities as examples. Document each assessment; do not assume the organisation is exempt merely because it is an SME.
Did the 2022 IAB Europe ruling remain untouched?
No. The 2025 Market Court annulled the original decision for procedural reasons while confirming the fine and key TCF reasoning, with a narrower conclusion about OpenRTB. Use the authority’s updated case account if the decision informs an ad-tech test. Do not turn that case into a general fine prediction for other businesses.
Which software should a Belgian company buy?
The one that passes its own register, language, request, consent-if-relevant and exit tests at an acceptable full cost. That might be a maintained spreadsheet with controlled processes, a focused tool or a wider platform. The APD/GBA does not require a named brand.
Make the offer match the real Belgian workflow
Choose the product after staff from the relevant entities and languages have completed the same trial and reviewed the export. Keep the regulator’s Article 30 requirements distinct from optional features and the IAB case distinct from your own advertising facts. A current record, an understandable response and a documented supplier decision are more useful than a generic “Belgium ready” badge.