Data Processing Agreement in Belgium: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract a controller must put in place with any processor that handles personal data on its behalf. In Belgium the content is set mainly by the GDPR, with the Belgian Data Protection Act of 30 July 2018 and the Belgian Data Protection Authority adding the local layer. This guide covers the law, the mandatory clauses and a working skeleton. It is general information, not legal advice; confirm a live deal with a Belgian lawyer. ## What law governs a DPA in Belgium? The core requirement comes straight from Article 28 of the GDPR, which applies directly in Belgium. Article 28(3) lists the terms a controller-to-processor contract must contain. On top of the GDPR: - The Belgian Data Protection Act of 30 July 2018 (Wet betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens / Loi relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel) supplements the GDPR and covers matters left to member states, including some public-sector and law-enforcement processing.

• The Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorite de protection des donnees, the GBA/APD) is the supervisory authority that enforces the rules and can impose corrective measures and fines. The DPA must be in writing, including electronic form. It does not replace the controller's own duties; it binds the processor to act only on documented instructions. ## The mandatory Article 28(3) clauses A compliant DPA must set out, at least: - Subject matter and duration of the processing.
• Nature and purpose of the processing.
• Type of personal data and categories of data subjects.
• Obligations and rights of the controller.
• Processing only on documented instructions, including for international transfers.
• Confidentiality of persons authorised to process the data.
• Security measures under Article 32 GDPR.
• Sub-processors: only with authorisation, and flowing down the same duties.
• Assistance to the controller with data subject rights and with Articles 32 to 36 (security, breach notification, impact assessments).
• Deletion or return of the data at the end of the services.
• Audits and inspections: making available the information needed to show compliance. ## Key clauses beyond the minimum - International transfers: identify any transfer outside the EEA and the safeguard used, usually the European Commission standard contractual clauses plus a transfer impact assessment.
• Breach notification timing: a concrete deadline for the processor to tell the controller, tighter than the controller's own 72-hour duty to the authority.
• Sub-processor list and change notice: a current list and a notice-and-object mechanism.
• Liability and indemnity: how losses and fines are shared, read together with the main contract.
• Records and cooperation with the GBA/APD: supporting the controller in dealings with the Belgian authority. ## A simple drafting skeleton 1. Parties, and their roles as controller and processor

2. Definitions aligned to the GDPR
3. Scope: subject matter, duration, nature, purpose, data types, data subjects
4. Processing only on documented instructions
5. Confidentiality of personnel
6. Security measures (Article 32)
7. Sub-processing and flow-down
8. International transfers and safeguards
9. Assistance with data subject rights and Articles 32 to 36
10. Personal data breach notification
11. Deletion or return on termination
12. Audits and information rights
13. Liability allocation
14. Governing law (Belgian) and forum
15. Annexes: processing details, security measures, sub-processors ## Common mistakes - Treating the DPA as boilerplate and leaving the processing-scope annex blank.

• Allowing sub-processors without a flow-down of the same obligations.
• Ignoring international transfers or relying on an outdated safeguard instead of the current standard contractual clauses.
• Omitting a concrete breach notification deadline for the processor.
• Confusing the controller and processor roles, or mislabelling a joint-controller relationship. ## Keeping data processing agreements under control If you sign DPAs with many vendors, the hard part is tracking which sub-processors each one allows, which transfer safeguard it relies on, and when each must be refreshed. That work (drafting from a tuned template, flagging missing Article 28 terms, tracking sub-processor changes and keeping versions straight) is what an AI contract workspace can hold in one place. Adira is built for this, with per-clause risk review and plain-English clause editing; it is India-first today with other jurisdictions on its roadmap, so verify local depth before relying on it for Belgian law. More at Adira. The law above stands on its own. ## Bottom line A Belgian DPA is driven by Article 28 of the GDPR, supplemented by the Data Protection Act of 30 July 2018 and enforced by the Belgian Data Protection Authority. Include every Article 28(3) term, handle international transfers with the current standard contractual clauses, annex the processing detail, and get Belgian advice before signing a real deal.