Belgium’s new Private Investigations Law: what it means for employers and employee privacy

In December 2024, Belgium introduced a significant update to its legislation on private investigations: the Wet tot regeling van de private opsporing (WPO). At first glance, this might seem relevant only to private detectives, but the law’s scope is much broader. In fact, it affects how companies conduct internal investigations and manage workplace incidents. If you’re an employer in Belgium, this law likely applies to you (even if you don’t hire private investigators).

Importantly, the WPO doesn’t stand on its own. It operates alongside the GDPR, and together, they impose a stricter regime around how personal data is gathered, processed, and used in the context of workplace investigations.

Broader scope than you might expect

The WPO defines “private investigation activities” in a broad way. These include any efforts to gather information about individuals or events on behalf of a third party (such as an employer), with the aim of protecting that third party’s interests in the context of an actual or potential conflict, or to trace missing persons or property.

That means workplace actions such as:

• Investigating internal fraud,
• Gathering evidence for dismissals,
• Verifying a candidate’s background before hiring,

…are all considered private investigation activities under this law.

The WPO does not just target external firms. It also applies to employers conducting investigations themselves, for instance, through their HR or compliance department.

Even the use of CCTV footage can fall under the WPO if it’s reviewed as part of an investigation into specific employee behaviour, such as misconduct or policy violations—turning a general security tool into a regulated private investigation activity.

What’s not covered?

Some activities fall outside the law’s definition of private investigation. These include actions carried out under a legal obligation, as long as private investigation isn’t their main objective. For example: Whistleblower investigations (in the narrow legal sense).

However, if findings from these investigations are later used for other purposes (such as initiating disciplinary action) the WPO rules must still be followed.

Employer obligations under the WPO

Demonstrate a legitimate interest

No investigation can begin unless the employer has a legitimate interest. Without it, the investigator must decline the assignment.

Licensing and identification

If your company is planning on using external private investigators or creating an internal investigative unit, the company must:

• Starting from Monday 16 June 2025, companies that use external private investigators or operate an internal investigative unit must hold a valid license issued by the Minister van Binnenlandse Zaken. This license will be valid for 5 years.
• Ensure investigators carry a valid ID card issued by the Directie Private Veiligheid van de FOD Binnenlandse Zaken, also valid for 5 years.

Employers conducting internal investigations through their HR department do not need a permit or an investigator ID card, however, this does not exempt them from the law’s broader obligations, outlined below.

Properly document the investigation

• An investigation assignment document must be drawn up, signed, and shared with all parties, describing the purpose and scope of the investigation.
• If the employer requesting the investigation is also the employer of the private investigator (i.e., the investigator is an internal employee), then the formal investigation assignment is not necessary, instead, a register noting the assignment details and investigation dates must be kept for five years.
• A chronological investigation file must be maintained during the process.
• Within one month of completing the investigation, the investigator must submit a written final report.
• The employer then has 30 days to decide whether to act on it. If not, all collected information must be destroyed, also fulfilling GDPR’s storage limitation and data minimization principles.
• If the employer does act, all affected individuals must be notified of:
  • The purpose and scope of data processing,
  • The timeframe of the investigation,
  • Their rights under the GDPR (access, rectification, erasure, objection).

No action may be taken until the individuals have had the opportunity to exercise these rights.

Establish an internal policy

Employers must create an internal policy on private investigations and inform employees before conducting such activities. This policy should clearly explain:

• When and how investigations may occur;
• How employees’ rights are protected.

There’s flexibility in how this is implemented, but a standalone company policy is likely the most practical option.

Employers have until 16 December 2026 to implement this policy. After that, no internal or external investigation may lawfully take place without it.

GDPR-wise, this policy serves as part of the employer’s information obligation (Articles 13 and 14) and helps to fulfil the principles of accountability and transparency.

Additional restrictions on certain methods

Some investigative methods, like interviews or confrontations, are tightly regulated. For example, interviews may only occur if the person being questioned:

• Gives explicit consent in advance, and
• Is fully informed of their rights and the interview’s purpose.

A written summary (signed by all parties) of the interview is mandatory.

Final takeaway

As you’ve seen, Belgium’s WPO creates a legal framework for private investigations that’s broader than you might expect, covering not just external detectives but also internal workplace inquiries. It aims for a careful balance between an employer’s right to investigate and employees’ rights to privacy and fair treatment.

If your company conducts internal reviews, now is the time to review your practices and update your policies to stay compliant.