One common EU regulation
The regulation applies directly across the EU and EEA where relevant. Organisations do not pick “Belgian GDPR” versus “French GDPR”: they apply the same core law and identify national provisions allowed within it.
Belgium, France and other jurisdictions
Belgium supplements the rules with its Law of 30 July 2018 and the Data Protection Authority. France has complementary data-protection law and the CNIL. Outside the EU, such as the UK, analyse the distinct UK GDPR/Data Protection Act framework and subsequent updates, as well as international transfers. Headquarters location alone does not determine applicability.
What to document
Processing records, purpose, lawful basis, controller/processor roles, contracts, access, retention, data subject rights, breach management and where required a DPIA. Consent is not the only lawful basis.
Common pitfalls
A published privacy policy is not compliance proof. EU hosting alone does not resolve access by non-EEA vendors. ISO 27701 certification does not replace statutory duties.
At a glance
| Question | EU/EEA | Belgium | United Kingdom |
|---|---|---|---|
| Core law | Regulation 2016/679 | GDPR + 30/07/2018 law | UK GDPR + DPA 2018 |
| Regulator | National DPAs / EDPB | Belgian DPA | ICO |
How SFERE can support
SFERE: data-flow mapping, access controls, minimisation, retention and technical evidence. Legal interpretation requires qualified advice.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.