[Last updated: 2 January 2020]

Yes.

☐ public company obligations (e.g., to notify security incidents that may materially affect an investor's decision)

☒ health regulatory requirements (e.g., to notify incidents affecting safety of medical devices)

☒ telecommunication requirements

☒ providers of critical infrastructure

☒ other

Reporting obligations for transport, caching and hosting services providers (Art. XII.20, §2 of the Belgian Economic Law Code of 28 February 2013).
Obligation for anyone to inform the public prosecutor about an attempt to harm - or about actual harm to - public security, or a person's life or property (Art. 30 of the Belgian Criminal Investigation Code).
Obligation for the controller to notify data breaches to any customer and/or authorities in accordance with the Belgian civil law principles of good faith and fairness and the general duty of care (Art. 1382 and seq. and Art. 1146 & seq. of the Belgian Civil Code).
Obligation for providers of operators of essential services as defined in the Act of 7 April 2019 to notify to the competent authority(ies) (CSIRT) of any incident having a significant impact on the availability, confidentiality, integrity or authenticity of networks and information system on which the essential service(s) depend.
Obligation for the digital services providers as defined in the Act of 7 April 2019 to notify to the competent authority(ies) (CSIRT) of any incident having a significant impact on the provision of the service (as defined in an annex to the Act of 7 April 2019) that they offer in the EU.

Details regarding the identified data security breach notification requirements

Limited notification obligation for providers of electronic communication services (Art. 114/1, §3 of the Act of 13 June 2005 on Electronic Communications)

This notification obligation applies to providers of electronic communication services (e.g., telecom operators, mobile phone communication services providers, internet access providers, etc.).

In case of a personal data breach (i.e., a breach of security accidentally or unlawfully resulting in the unauthorized destruction, loss, alteration, disclosure or access of personal data transmitted, stored or otherwise processed in connection with the provision of publicly available electronic communications services in the Community), providers of such electronic communication network or services must notify the Belgian Data Protection Authority without undue delay.

Besides, where the personal data breach is likely to adversely affect a subscriber or individual's personal data, the provider shall notify the subscriber or individual without undue delay. The notification to the subscriber or individual shall at least describe the nature of the personal data breach and the contact points where more information can be obtained, and shall recommend measures to mitigate the possible adverse effects of the personal data breach.

Notification of a personal data breach to a subscriber or individual concerned shall not be required if the provider demonstrates, to the satisfaction of the competent authority, that it has implemented appropriate technical protection measures, and that those measures were applied to the data concerned by the security breach. Such technical protection measures shall render the data unintelligible to any person who is not authorized to access it.

Failure to comply would result in liability in case such failure would contribute, directly or indirectly, in whole or in part, to harm to the affected individual(s) or any person holding an interest in the data which has been breached. The Belgian telecommunication regulator may also require public network operators or electronic communication service providers to implement security requirements and audits; it may also impose administrative fines, such as prohibiting the delivery of the relevant services in case of non-compliance. This is without prejudice to the obligation to notify the Belgian telecommunication regulator (IBPT) of any security breach or loss of integrity having a significant impact on the functioning of the networks or services.

Reporting obligations for transport, caching and hosting services providers (Art. XII.20, §2 of the Belgian Economic Law Code of 28 February 2013)

Transport, caching and hosting services providers must report without delay to the competent judicial or administrative authorities alleged illegal activities of - or alleged illegal information reported by - the recipients of their services; this may then apply to unauthorized access to and/or use of data they are transporting, caching or hosting.

Such services providers must also provide the competent judicial or administrative authorities, on mere demand, with the information they hold and that is useful for the investigation and confirmation of criminal offenses committed through their channel.

Under this provision, affected individuals must not be notified.

Failure to comply would result in liability if such failure contributes, directly or indirectly, in whole or in part, to harm to the affected individual. Information society providers not complying with their information or reporting duty may be punished by a criminal fine from EUR 208 to EUR 500,000. They can theoretically be subject to cease and desist actions.

Obligation for (i) operators of essential services and (ii) digital services providers to notify the competent authority(ies) (including the CSIRT) without undue delay of incidents having a significant impact on (i) the availability, confidentiality, integrity or authenticity of networks and information systems on which the essential services depend and (ii) their services (as defined by the Act of 7 April 2019) that they offer in the EU.
Obligation to inform the public prosecutor about an attempt to harm - or about actual harm to - public security, or a person's life or property (Art. 30 of the Belgian Criminal Investigation Code)

This provision requires anyone who knows about an attempt to harm - or about actual harm to - public security, or a person's life or property, to immediately inform the public prosecutor thereof; this may then apply to a hacking incident consisting in (or being part of) an attempt to harm (or actual harm to) a person's life or property (including data).

Under this provision, affected individuals must not be notified.

Failure to comply would result in civil liability if such failure contributes, directly or indirectly, in whole or in part, to harm to the affected individual.

Obligation for the controller to notify data breaches to any customer and/or authorities in accordance with the Belgian civil law principles of good faith and fairness and the general duty of care (Art. 1382 and seq. and Art. 1146 & seq. of the Belgian Civil Code)

In accordance with the Belgian civil law principles of good faith and fairness in contractual relationships, as well as the general duty of care, a controller or a processor should inform its customers or other persons affected (or even the public at large, e.g., for the sake of reaching a large audience when it is not possible to identify precisely the persons affected), and/or authorities of a data breach, where such information could help in mitigating the prejudice suffered by customers or third parties, if any, or address the consequences of a data breach. This notification duty is not limited to personal data and could apply to any type of data or customer (such as data pertaining to legal entities).

The scope and timing of such information mainly depend on what is necessary, in light of the circumstances of the case, to allow the affected individuals or third parties to take any appropriate measures to mitigate or to avoid their (potential) prejudice.

Failure to comply with the general duty of care provisions or principles would result in liability if such failure contributes, directly or indirectly, in whole or in part, to harm to the affected individual.