What are the implications for employers and what compliance measures and next steps should they take?
The new Private Investigation Act has introduced significant changes to the scope of private investigations for companies in Belgium. The legislation covers activities performed by individuals at the company's request to gather intelligence on individuals, with the aim of protecting the employer's interests in potential conflicts.
Corporate internal investigations into employee fraud or irregularities are in-scope, as are background checks on candidates. Out-of-scope activities include routine HR inquiries, workplace data reviews, audits that do not involve specific individuals, and reference checks during recruitment.
However, investigations into a person's health, political beliefs or trade union affiliation are expressly prohibited.
Internal investigation applicability
The act applies to both external investigators and employers conducting internal investigations. However, individuals performing legal duties, such as health and safety advisors or whistleblower follow-up personnel, are excluded.
External lawyers can also conduct investigations on behalf of the company without being subject to the legislation.
HR exemptions
Internal investigations led by HR staff are exempt from obtaining a special licence and identification card, but must still comply with privacy and GDPR regulations. The exemption does not apply to investigations into third parties or non-employees.
Company main obligations
Companies must draft a clear policy outlining investigation circumstances and methods, ensuring compliance with data privacy safeguards. This policy must be adopted by 16 December 2026.
There is also a consultation obligation on employers. Before implementing the policy, employers will need to consult their collective body, such as their works council or trade union delegation.
Setting up specific investigation documents (format and content depend on whether the investigation is done internally or externally).
Companies are also obliged to undertake employee notification. Before using investigation findings, employers must notify employees about the investigation's main details, including its purpose, scope, timeline and data rights.
Internal investigation departments' obligations
Investigators must meet three cumulative conditions before starting activities:
- Possession of a valid licence (except HR department).
- Compliance with legal stipulations, including ethical standards and avoiding conflicts of interest.
- Verification that the investigation serves a legitimate interest.
Investigation departments must also adhere to procedural obligations, including transparency and consent, investigation documentation and compliance with the General Data Protection Regulation.
Composition of internal investigation departments
Investigators must deliver a final report within one month of completing the investigation. The employer must decide within 30 days whether to use the report. If not used, the report must be destroyed.
Investigators must inform the targeted person and any other identifiable person if the report is used. Employers will need to consider carefully the composition of their internal investigation department, avoiding the inclusion and involvement of persons who can legally represent the company and impose sanctions.
Osborne Clarke comment
There are a series of next steps that employers can take. A checklist of actions for employers would include:
- Draft a policy and consider whether external investigators will be necessary.
- Consult collective bodies and engage with the works council or union delegation.
- Update the company's privacy policy to reflect new personal data processing in internal investigations.
- Review the composition of the investigation department to ensure appropriate personnel are involved.
- Evaluate investigation conductors and decide whether to use internal or external investigators and ensure they meet legal requirements.
