Belgium: New Private Investigations Act (PIA) – Key Implications for Employers
Belgium’s Private Investigations Act (PIA) came into force in December 2024. The PIA introduces stricter compliance and enhanced privacy protections for employees.
Employers will need to adapt to new licensing requirements, investigation protocols, and employee privacy rights. While certain aspects allow a two-year transition, many obligations take immediate effect.
The PIA seeks to balance employer need for internal investigations with employee privacy rights, placing an emphasis on ethical practices. It will significantly reshape employer investigation practices in Belgium.
What is caught?
The PIA applies to:
- Internal company and corporate group investigations.
- External private investigators.
Private investigation activities are:
- Performed by a natural person.
- Conducted by individuals on behalf of employers (public or private sector).
- Involve collection and processing of personal data.
- Aim to protect employer interests in disputes.
The PIA does not apply to:
- Professional activities of lawyers, notaries, bailiffs, journalists, and auditors.
- Cybersecurity-related investigations.
- Investigations under legal obligations (e.g., whistleblowing reports, psychosocial risk complaints).
Employer Obligations
Licensing
Employers must obtain authorisation from the Ministry of the Interior (valid for five years) or alternatively, work with licensed investigators.
HR departments however do not need to obtain the licence but must nevertheless comply with PIA rules.
Compliance
By December 16th 2026, employers must have:
- Implemented clear internal investigation procedures;
- Informed relevant individuals of investigations and their rights;
- Maintained full investigation records;
- Provided feedback within one month of an investigation;
- Ensured they are complying with GDPR and PIA rules;
- Reported relevant matters to criminal authorities when required.
There are several non-compliance risks to be aware of. Non-compliance can result in:
- Labour courts nullifying unlawfully obtained evidence.
- Administrative fines up to EUR 25,000.
- GDPR-related fines up to EUR 20 million or 4% of annual turnover.
- Potential criminal sanctions.
What should Employers do?
To ensure compliance employers should:
- Review and update internal policies.
- Train HR and compliance teams on PIA requirements.
- Seek legal guidance for compliance where there is uncertainty.
- Implement necessary documentation and reporting measures.
- Strengthen data protection practices.
This is a high level general update only. Legal advice should be obtained on specific circumstances.