GDPR: 3 common mistakes to fix before a complaint lands
No processing records, cookies without real consent, a breach reported too late: the 3 GDPR mistakes to fix first, with the Belgian DPA's 2025 figures.
What Belgian DPA checks really look like
In 2025, the Belgian Data Protection Authority (DPA) received 1,216 data breach notifications and assessed the admissibility of 1,423 complaints. It imposed 4 fines, totalling €75,700 (€59,700 after appeals). Fines remain rare in Belgium. But a single complaint from a client, an employee or a competitor is enough to trigger an investigation, compliance orders and a real cost in time and reputation.
The good news? The three mistakes below are easy to fix, as long as you know what they are.
Did you know?
According to its 2025 annual report, the DPA's Inspection Service keeps prioritising cookie management and the quality of website privacy notices, as well as direct marketing. For the DPA, your website is often your business card.
3 mistakes to fix first
1. No record of processing activities. The record (GDPR Article 30) is the first document you will be asked for in an inspection. It lists every processing of personal data, its purpose, the categories of data, the recipients and the retention period. Companies with fewer than 250 employees are only exempt if their processing is occasional, low-risk and involves no sensitive data: an SME that runs payroll or a client database needs one. Our GDPR training covers this with a ready-to-use template.
2. Poorly managed consent. A cookie banner that sets trackers before any choice is made, a "Reject" button that is hidden or less visible, opt-out instead of opt-in for marketing. The DPA notes that controllers still regularly have to fix consent for non-essential cookies and the way choices are presented (for example through the use of colour). The rule: consent must be freely given, specific, informed and unambiguous. Our GDPR training reviews your forms and cookies.
3. No breach notification procedure. You have 72 hours to notify the DPA of a personal data breach when it poses a risk to individuals (Article 33). Without a written procedure, that is almost impossible. And breaches are often mundane: in 2025, the most frequently notified causes were an email sent to the wrong recipient (12.85%), a letter or parcel sent to the wrong address (9.98%) and phishing (9.85%). A clear procedure and aware teams make the difference.
Take action
Three things to do this week:
- Assess your compliance level with our free mini-audit. A few minutes, no commitment.
- Train your team. Our GDPR training is available as a lunch & learn, half-day or conference. Discover the programme.
- Need support? We help you prioritise and get the basics in place. Contact us.
Better to be ready before the DPA's letter arrives.
