Belgium Adopts New Act on Private Investigations

On December 16, 2024, the Act entered into force.

The new Act is not only applicable to companies whose core business is private investigation activities, but also to internal investigations or inquiries (e.g., in relation to fraud and/or compliance) conducted within other companies. Aside from specialized in-house investigation departments, other departments such as HR or legal that only occasionally conduct an investigation (e.g., within the framework of a dismissal for serious cause, but also in preparation of formal litigation and gathering evidence) fall within the scope of the Act. Exceptions exist for certain activities and professions (e.g., lawyers). 

License and Identification Card

Companies falling within the scope of application will need a license from the Belgian Ministry of Internal Affairs in order to be allowed to conduct investigations. In companies with an in-house investigation department, the investigators and the individuals who are factually in charge of managing the investigation department will also need an identification card issued by the same Ministry. HR personnel investigating occasional incidents involving employees do not need a license or identification card, but must still comply with other provisions of the Act.

The license must be applied for within six months after the Act's date of entry into force (i.e., before June 16, 2025). 

Legitimate Interest

The Act mandates that, whether an investigation is conducted internally or by an external private investigator, there must be a verified and documented "legitimate interest" for the investigation in the interests of transparency and accountability. This is generally understood to pertain to safeguarding the company's legitimate interests in actual or potential conflicts or proceedings, such as disputes involving employees or other stakeholders, and recovering lost or stolen property. The Act emphasizes that the investigation must be aimed at providing information that is relevant and necessary in light of those interests, so as to avoid investigations being conducted for arbitrary or intrusive purposes and to protect individual rights and privacy.

Policy

Employers are only allowed to investigate their employees if a specific policy on this topic has been implemented. This policy must provide clear and transparent information regarding the permissibility and modalities of the investigations. The Act provides for a transitional period of two years to implement such policy (i.e., until December 16, 2026).

Interviews and Other Investigative Techniques

Interviews as part of an internal investigation can only take place if the interviewee gives explicit, written consent thereto. 

The investigator must also inform the interviewee prior to the interview about the reason for and at the request of whom they are being interviewed, the purpose for which their statements can be used, and their rights during the interview. These rights include that: the interviewee is not obliged to answer the questions; they have the right to read and correct the minutes of the interview; they can obtain a copy of the minutes of the interview; they are not obliged to sign the minutes; they can be assisted during the interview by a person of their choice; and they can end the interview at any time.

The consent requirement also applies to certain other investigative techniques. The Act prohibits investigative techniques based on deceit, provocation or consulting nonpublic personal data.

Register, Investigation File, and End Report

It is mandatory to keep a register of all investigation assignments as well as an investigation file, in which all documents and a chronological overview of all actions performed are kept. In case of an audit by the authorities, they may consult this investigation file to check compliance with the Act.

Within a month after the last investigation measure, the investigator must submit a written investigation report (end report) to the employer. 

Processing of Personal Data

The Act contains specific GDPR-related rules, such as rules on the retention (period) for the investigation files, the employee's right to receive certain information about the personal data that was processed in the end report of the investigation, etc. 

Investigations in certain sensitive fields are explicitly prohibited, such as investigations about political beliefs; trade union membership; genetic, biometric and health data; undisclosed suspicions as a result of a criminal or judicial investigation; prosecutions or convictions for committing crimes, administrative sanctions or safety measures.

Sanctions

Different sanctions can be imposed in case of noncompliance with the Act. The most important ones are the unlawfulness and inadmissibility in court of evidence, administrative fines up to €25,000 and sanctions under the GDPR. Severe violations of GDPR (e.g., unlawful data processing during the investigation) may lead to fines of up to €20 million or 4% of global annual turnover, whichever is higher. Less severe violations (e.g., inadequate security measures) may result in fines of up to €10 million or 2% of global annual turnover.