Legal requirements for websites in Belgium

Code of Economic Law (CEL), Books III and XII

• Full company name and legal form (e.g. BV/SRL, NV/SA)
• Full address of the registered office
• Telephone number and email address
• Company registration number (BCE/KBO): 10 digits
• VAT number: BE + 10 digits
• Name of the responsible publisher (where applicable to the content)
• Contact details of the webmaster or site administrator

Penalty: EUR 50 – 5,000 per missing element

VAT Code / CEL Book III

• VAT number visible on every page (e.g. in the footer)
• Small business VAT exemption available only up to EUR 25,000 annual turnover
• Apply the correct VAT rates (21%, 12%, 6%, 0%)

Penalty: EUR 1,000 – 5,000 administrative fine

GDPR Arts. 13–14 / Belgian Data Protection Act

• Identity and contact details of the data controller
• Purposes and legal basis of each processing activity
• Categories of personal data collected
• Recipients or categories of recipients (including processors)
• Retention periods per data category
• Data subject rights: access, rectification, erasure, restriction, portability and objection
• Right to lodge a complaint with the Data Protection Authority (DPA), including its contact details
• Information on automated decision-making and profiling

Penalty: Up to EUR 10–20 million or 2–4% of global annual turnover

GDPR Art. 28

• Written data processing agreement with every processor (hosting, analytics, payment services)
• Set out the subject matter, duration, nature and purpose of the processing
• Sub-processors: prior authorisation and transparency
• Document the security measures in place

Penalty: Up to EUR 10–20 million or 2–4% of global annual turnover

GDPR Arts. 6–7

• Consent checkbox that is not pre-ticked
• Statement of the purpose and retention period
• Link to the privacy policy
• Record consent (keep evidence)

Penalty: Up to EUR 10–20 million or 2–4% of global annual turnover

GDPR Arts. 33–34

• Notify the DPA within 72 hours of becoming aware of the breach
• Part 1: basic information (within 72 hours) / Part 2: full details (within 21 days)
• Inform affected individuals if there is a high risk to them
• Maintain a data breach register
• Language: Dutch, French or German

Penalty: Up to EUR 10–20 million or 2–4% of global annual turnover

GDPR Chapter V / Schrems II (C-311/18)

• A valid transfer mechanism (e.g. an adequacy decision or Standard Contractual Clauses (SCCs)) for transfers outside the EU/EEA
• Supplementary technical measures (encryption, pseudonymisation)
• Document a transfer impact assessment (TIA)
• Relevant when using US services (Google, Cloudflare, AWS)

Penalty: Up to EUR 10–20 million or 2–4% of global annual turnover

GDPR Art. 37

• Required for public authorities and for organisations whose core activities involve large-scale monitoring or large-scale processing of sensitive data
• Publish the DPO's contact details on the website
• Notify the DPA of the DPO's contact details
• Not required for most SME websites

Penalty: Up to EUR 10–20 million or 2–4% of global annual turnover

Electronic Communications Act, Art. 129 / ePrivacy Directive, Art. 5(3)

• Explicit consent BEFORE any non-essential cookies are placed
• "Accept all" and "Reject all" buttons equally prominent
• Granular choices per category (analytics, marketing, preferences)
• Withdrawing consent must be as easy as giving it
• No cookie wall (refusing consent must not block access)
• No pre-ticked boxes (dark patterns prohibited)
• Keep proof of consent

Penalty: EUR 500 – 50,000 (ePrivacy) + GDPR fines

Google requirement (mandatory for Google services since March 2024)

• Consent signals for analytics_storage and ad_storage
• Default state set to 'denied' until the user makes a choice
• wait_for_update parameter to allow the banner to load
• Granular signals: ad_storage, ad_user_data, ad_personalization, analytics_storage

Penalty: Loss of Google Ads/Analytics functionality

Electronic Communications Act, Art. 129 / GDPR Art. 13

• Details for each cookie category: name, purpose and retention period
• Distinguish between essential and non-essential cookies
• Explain strictly necessary functional and security cookies (exempt from consent)
• Link to the cookie preference settings
• Reference to the privacy policy

Penalty: EUR 500 – 50,000

CEL Book VI, Arts. VI.45–46 / Directive 2011/83/EU

• Full description of the product or service
• Total price including VAT and all charges
• Delivery costs stated separately (or stated as free)
• Available payment methods
• Delivery period (default: maximum 30 days)
• Right of withdrawal: 14 calendar days
• Complaints procedure and ADR information
• Seller identity (name, address, BCE/KBO number, VAT number)

Penalty: EUR 100 – 1,000 per violation

CEL Book VI, Arts. VI.47–56 / Directive 2011/83/EU, Arts. 9–16

• Consumers have 14 calendar days from receipt of the goods to withdraw
• The consumer does not have to give a reason
• A model withdrawal form must be provided
• Full refund (including standard delivery costs) within 14 days
• Exceptions: perishable goods, sealed goods unsealed after delivery for health or hygiene reasons, custom-made items, digital content (once supply has begun with the consumer's consent)

Penalty: EUR 500 – 5,000 per violation

CEL Book VI / Directive 98/6/EC

• Prices always displayed including VAT
• Unit price where applicable (per kg, litre or item)
• Total final price clearly shown before checkout
• No hidden costs or surcharges
• Ban on payment method surcharges (PSD2 Art. 62)

Penalty: EUR 100 – 1,000 per violation

CEL Book VI, Art. VI.46

• Confirmation on a durable medium (email is sufficient)
• Restate all essential contract terms
• Include the withdrawal form
• Send no later than the time of delivery

Penalty: EUR 100 – 1,000 per violation

Belgian Civil Code (consumer sales) / Directive (EU) 2019/771

• Minimum 2-year legal warranty on all new goods
• The consumer chooses between repair and replacement (free of charge)
• Burden of proof on the seller for the full 2 years
• Second-hand goods: may be reduced to a minimum of 1 year (if agreed)
• Must be stated on product pages and in the T&Cs

Penalty: EUR 500 – 5,000

CEL Book VI / Directive (EU) 2019/770

• Compatibility information (operating system, storage space)
• Describe the access and activation method
• State usage rights and restrictions
• The right of withdrawal lapses once supply begins with the consumer's explicit consent

Penalty: EUR 500 – 5,000

Directive 2005/29/EC (UCPD) / CEL Book VI

• Prohibited: false information, fake reviews, misleading discounts
• Prohibited: false scarcity claims ('Only 2 left!') where untrue
• Prohibited: aggressive sales techniques
• Prohibited: obstructing withdrawal or cancellation rights
• Essential information must not be omitted

Penalty: EUR 500 – 10,000 + injunction

Regulation (EU) 524/2013 / Directive 2013/11/EU

• EU ODR platform discontinued in 2025 (no new complaints since March 2025); links to it should be removed
• Information on the available ADR schemes on the website
• Belgian ADR bodies: Belmed, sector-specific ombudsmen
• Email address for complaints clearly stated

Penalty: EUR 500 – 2,000

Regulation (EU) 2023/988 (GPSR) / CE marking legislation

• All products must meet the applicable safety requirements
• CE marking mandatory for the relevant product categories
• Technical documentation and EU declaration of conformity
• Traceability: batch and serial numbers

Penalty: Criminal: up to EUR 200,000 or 6% of turnover

Directive (EU) 2015/2366 (PSD2)

• At least two authentication factors required for payments
• Factors: knowledge (password), possession (phone), inherence (biometrics)
• Exemptions: transactions under EUR 30, recurring payments, trusted beneficiaries
• Responsibility of the payment service provider, but the online shop must integrate it

Penalty: Payments declined if non-compliant

PSD2 Art. 62

• No additional charges for specific payment methods
• No surcharges for credit cards, PayPal, Bancontact, etc.
• Exception: only where the actual cost is demonstrably higher

Penalty: EUR 100 – 5,000 per violation

Act of 6 February 2024 / EN 16931 / Peppol framework

• Mandatory since 1 January 2026 for B2B transactions between Belgian VAT-registered businesses
• Structured format: UBL 2.1 or CII 16B
• Exchanged via the Peppol four-corner network
• Tolerance period: January–March 2026 without penalties
• This concerns the invoicing/accounting system, not the website itself

Penalty: EUR 1,500 (1st), EUR 3,000 (2nd), EUR 5,000 (3rd and subsequent violations)

Directive (EU) 2019/882 / EN 301 549 V3.2.1

• In force since 28 June 2025 (micro-enterprises providing services are exempt)
• Technical standard: WCAG 2.1 Level AA via EN 301 549 (WCAG 2.2 AA recommended)
• Existing services under contracts concluded before June 2025: transition period until June 2030
• Keyboard navigation, colour contrast (4.5:1), alt text, ARIA labels
• Forms must be accessible to screen readers

Penalty: Up to EUR 200,000 per violation

EAA / Directive (EU) 2019/882

• Public page on the website (e.g. /accessibility)
• State the compliance status (fully, partially or not compliant)
• Document known limitations honestly
• Contact mechanism for reporting accessibility issues
• Date of preparation and next review

Penalty: Up to EUR 200,000 per violation

Regulation (EU) 2024/1689, Art. 50

• Chatbots: inform users that they are interacting with AI
• AI-generated content: label it clearly
• Deepfakes and synthetic media: mark them visibly
• Applicable from: 2 August 2026
• Belgian supervisory authority: BIPT

Penalty: Up to EUR 15 million or 3% of global annual turnover

Regulation (EU) 2022/2065

• Mainly relevant for online platforms and marketplaces; the strictest obligations apply to very large online platforms (45M+ monthly active EU users)
• Largely not applicable to standard SME websites or online shops
• If applicable: transparency of recommender systems, ad labelling, complaints procedure

Penalty: Up to 6% of global annual turnover

CEL Book XII / ePrivacy Directive, Art. 13

• B2C: explicit opt-in required (soft opt-in for existing customers regarding similar products)
• B2B: opt-out permitted for generic business addresses (not personal ones)
• Every email must contain an unsubscribe link
• Sender must be clearly identifiable
• Process unsubscribe requests within 10 days
• Keep evidence of consent

Penalty: EUR 100 – 1,000 per violation (per recipient for bulk mailings)

Electronic Communications Act / ePrivacy Directive

• SMS to consumers: explicit opt-in required
• SMS to businesses: opt-out permitted
• Telephone canvassing: consumer consent required
• Process opt-out requests within 10 days

Penalty: EUR 100 – 1,000 per violation

Belgian public health legislation

• Beer and wine: minimum age 16
• Spirits: minimum age 18
• Age verification mandatory at checkout and on delivery
• Online sales permitted (subject to age verification)

Penalty: Criminal sanctions

Belgian tobacco law

• Online sale of tobacco products and e-cigarettes is PROHIBITED
• No exceptions for online shops

Penalty: Criminal sanctions + product seizure

FAMHP (AFMPS/FAGG) regulations

• Prescription medicines: online sale prohibited
• Non-prescription (OTC) medicines: online sale permitted only by licensed pharmacies, subject to conditions
• Supervised by the FAMHP (Federal Agency for Medicines and Health Products)

Penalty: Criminal sanctions

GDPR Art. 32 / PSD2 / Industry standard

• TLS 1.2 or higher
• Across the entire site (not just the checkout)
• Valid SSL/TLS certificate from a trusted certificate authority (CA)
• HSTS header recommended

Penalty: GDPR fines if a data breach occurs due to missing encryption

CEL / Belgian Civil Code

• Description of the products or services, prices and payment terms
• Limitation of liability
• Intellectual property rights
• Dispute resolution (competent court, applicable law)
• Amendment procedure and termination
• Additional e-commerce terms: right of withdrawal, warranty, returns procedure, delivery terms

Penalty: EUR 500 – 5,000 for unfair terms

Belgian language legislation

• No statutory website language requirement for private companies
• Consumer contracts: essential information in the consumer's language recommended
• Privacy policy and T&Cs: at least Dutch and French (best practice)
• Accessibility statement: in all relevant languages
• A contract may be unenforceable if drafted in the wrong language

Penalty: Contract may be unenforceable

Regulation (EU) 2018/302

• Prohibited: blocking or redirecting customers based on nationality or place of residence
• Price differences by location: allowed only where justified by VAT or cost differences
• Payment methods must not be refused based on location
• Exceptions: licensing restrictions, security, age restrictions

Penalty: EUR 500 – 5,000 + injunction