Belgian Data Protection Authority guidance on AI systems and the GDPR

What it is

The Belgian Data Protection Authority, known as the Autorité de protection des données in French and the Gegevensbeschermingsautoriteit in Dutch, is Belgium’s GDPR supervisor. Its General Secretariat monitors social, economic and technological developments that affect the protection of personal data, and in that role published Artificial Intelligence Systems and the GDPR, A Data Protection Perspective. The current text is the original version of December 2024.

The brochure sets out to explain the GDPR requirements that apply to AI systems processing personal data, and to show how the EU AI Act, in force since 1 August 2024, adds to them. Its examples are teaching examples, sometimes hypothetical, and do not account for every exception in the law.

Who it applies to

The brochure is written for legal professionals, data protection officers and technical staff, including business analysts, architects and developers, and for controllers and processors that develop and deploy AI systems. It is explicitly meant to connect legal requirements with technical implementation.

The GDPR applies to any organisation established in Belgium that processes personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. Belgium’s Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data supplements the GDPR, mostly for processing by public authorities.

What it covers

Lawfulness, fairness and transparency. The GDPR’s six legal bases in Article 6 remain the bases for AI that processes personal data. The AI Act adds outright prohibitions, such as social scoring, builds on the GDPR’s fairness principle through its focus on bias and discrimination, and requires people to be told when they are interacting with an AI system.

Purpose limitation and minimisation. Personal data must be collected for specific purposes and limited to what is necessary. The brochure’s example is a loan approval system that also uses geolocation and social media data, which raises concerns under the GDPR. The AI Act reinforces this for high-risk systems by requiring a well-defined and documented intended purpose.

Accuracy. Personal data must be accurate and up to date, and the AI Act requires high-risk systems to use high-quality data to prevent discriminatory outcomes. The example is a loan model trained on a period when loans were granted more readily in wealthier neighbourhoods, which carries that bias forward through postal codes.

Automated decisions. The GDPR’s Article 22 gives an individual right to have a human reconsider a solely automated decision. The AI Act’s human oversight is a governance measure for high-risk systems that runs across the lifecycle, from reviewing training data for bias to monitoring performance and intervening in critical decisions.

Security. GDPR technical and organisational measures are the baseline, and AI adds risks such as biased training data and manipulation of training data by attackers. The brochure points to risk assessment, continuous monitoring and testing for security flaws and bias, and human oversight.

Data subject rights. Clear explanations of how an AI system uses data help people exercise their rights. In the brochure’s example, a life insurance customer told which data drove a high premium can then ask for inaccurate data to be corrected.

Accountability. GDPR accountability rests on transparent processing, documented policies and legal bases, records of processing, security measures, data protection impact assessments and, where required, a data protection officer. The AI Act builds on this with risk classification, a fundamental rights impact assessment for some high-risk systems, documentation, human oversight processes and incident reporting.

The brochure ends with user stories for a life insurer implementing AI to calculate premiums, turning each principle into a concrete requirement for the team building the system.

Key dates

• 25 May 2018. GDPR applies.
• 1 August 2024. EU AI Act enters into force.
• December 2024. Date of the current version of the brochure.
• 2 August 2026. AI Act general application, including Article 50 transparency.
• 2 December 2027. Annex III high-risk obligations apply, as amended by the Digital Omnibus.

How it relates to other frameworks

The brochure reads the GDPR and the EU AI Act together, which is how a Belgian organisation will meet them in practice. Its lifecycle view of risk, testing and oversight lines up with ISO/IEC 42001 and the NIST AI RMF, and the EU’s ALTAI checklist is a practical way to work through fairness and transparency for a specific system.

A note on this page

This is Aicura’s summary of the Belgian Data Protection Authority’s brochure. It is not legal advice and it is not the brochure itself. Read the document published by the Authority, and take advice on how the GDPR and the AI Act apply to your organisation.