{"id":3811,"date":"2026-09-04T13:40:39","date_gmt":"2026-09-04T13:40:39","guid":{"rendered":"https:\/\/www.nonzerosum.be\/privacy-policy-under-gdpr-what-is-mandatory\/"},"modified":"2026-10-27T16:11:47","modified_gmt":"2026-10-27T16:11:47","slug":"privacy-policy-under-gdpr-what-is-mandatory","status":"publish","type":"post","link":"https:\/\/www.nonzerosum.be\/en\/privacy-policy-under-gdpr-what-is-mandatory\/","title":{"rendered":"Privacy policy under the GDPR: what is mandatory?"},"content":{"rendered":"
\n
\n
\n \n\n

A sound\u00a0privacy policy<\/strong>\u00a0is much more than a standard text at the bottom of a website. It must make clear which personal data an organisation processes, why that is done and which rights customers, employees, applicants, suppliers and other data subjects have. Under Belgian law, the GDPR forms the principal framework, supplemented by Belgian data protection legislation.<\/p>\n\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n \n\n

What must a privacy policy make clear?<\/h2>\n\n\n\n

A correct\u00a0privacy policy<\/strong>\u00a0must explain in understandable language which personal data are collected, for which purposes they are used and on which legal basis the processing relies. It must also be clear how long the data are retained, to whom they may be disclosed and whether data are processed outside the European Economic Area. The identity and contact details of the controller must also be stated. If a data protection officer has been appointed, that person’s contact details must also be available.<\/p>\n\n\n\n

What rights do data subjects have?<\/h2>\n\n\n\n

The GDPR grants data subjects various rights. A\u00a0privacy policy<\/strong>\u00a0must inform them of those rights clearly. Depending on the situation, this includes among other things the right of access, rectification, erasure, restriction of processing, data portability and objection.<\/p>\n\n\n\n

<\/h4>\n\n\n\n

Where processing is based on consent, it must also be explained that that consent may be withdrawn again. It must furthermore be stated that data subjects may lodge a complaint with the Data Protection Authority.<\/p>\n\n\n\n

How long may personal data be retained?<\/h2>\n\n\n\n

Personal data may not be retained indefinitely. An organisation must therefore indicate in its\u00a0privacy policy<\/strong>\u00a0which retention periods apply, or at least according to which criteria those periods are determined. Those periods must be aligned with the purpose for which the data are processed, statutory obligations and the organisation’s actual needs.<\/p>\n\n\n\n

The privacy policy must correspond to practice<\/h2>\n\n\n\n

A text can sound legally sound, but that is not sufficient. The\u00a0privacy policy<\/strong>\u00a0must correspond to the actual processing of data within the organisation. What is communicated externally must match internal processes, retention periods, security measures and procedures. The policy must therefore also be consistent with internal\u00a0compliance<\/strong>\u00a0and, where relevant, with a\u00a0DPA<\/strong>\u00a0or processor agreement.<\/p>\n\n\n\n

Additional attention for certain organisations<\/h2>\n\n\n\n

A\u00a0municipality<\/strong>,\u00a0hospital<\/strong>\u00a0or organisation within the\u00a0public sector<\/strong>\u00a0often processes large volumes of personal data or sensitive data. That may entail additional obligations, such as the appointment of a data protection officer, stricter security measures or a data protection impact assessment for high-risk processing. Particularly in the case of health data, large-scale processing or public service delivery, a standard privacy statement is therefore often insufficient.<\/p>\n\n\n\n

A sound privacy policy reduces legal risks<\/h2>\n\n\n\n

A correct\u00a0privacy policy<\/strong>\u00a0helps organisations not only to meet their information obligation. It also makes clear which choices have been made internally and reduces the risk of complaints, disputes and sanctions. What remains most important is that the policy is not only drafted in a legally correct manner, but also corresponds to what the organisation actually does with personal data.<\/p>\n\n\n\n

<\/p>\n\n <\/div>\n <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

A privacy policy is much more than a mandatory formality at the bottom of your website: it must accurately reflect how your organisation actually handles personal data. Discover which mandatory particulars on legal bases, retention periods and data subjects’ rights are essential to avoiding sanctions under the GDPR.<\/p>\n","protected":false},"author":0,"featured_media":2386,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","nzs_testimonials_section_type":""},"categories":[1],"tags":[],"class_list":["post-3811","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-niet-gecategoriseerd"],"_links":{"self":[{"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/posts\/3811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/comments?post=3811"}],"version-history":[{"count":1,"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/posts\/3811\/revisions"}],"predecessor-version":[{"id":3830,"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/posts\/3811\/revisions\/3830"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/media\/2386"}],"wp:attachment":[{"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/media?parent=3811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/categories?post=3811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nonzerosum.be\/en\/wp-json\/wp\/v2\/tags?post=3811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}