THE BELGIAN DPA'S MANAGEMENT PLAN 2027: DATA BROKERS AND VIDEO GAMES IN FOCUS AS THE REGULATOR TURNS MORE PROACTIVE

To define its concrete priorities, the DPA applies what it calls a circular approach: the activities of its various departments are designed to align with, and reinforce, one another. Annual priorities are split into two complementary strands: information and awareness-raising, and enforcement action. The theme prioritised for awareness-raising in a given year is, in principle, expected to become a priority enforcement theme two years later, and lessons drawn from enforcement feed back into future awareness themes, creating a continuous cycle.

For 2027, the DPA's information and awareness-raising efforts will focus on :

• profiling and data reuse in the banking sector;
• health data processing (notably via health apps);  and
• booking data in the hospitality (Horeca) sector.

In addition, the DPA will work on updating its guidelines on technical and organisational security measures and on new guidelines at the EDPB and Coordinated Enforcement Framework levels.

On the enforcement side, the DPA will proactively target two themes:

• data processing by data brokers; and
• data processing in the context of video games.

1.1 The Executive Committee

The DPA is led by its Executive Committee and comprises five departments, whose activities can be summarised around five complementary pillars: informing, raising awareness, advising, approving and sanctioning, which reinforce each other in the same circular logic described above.

The Executive Committee, composed of the directors of the five departments, sets the DPA's strategic policy, ensures coordination and represents the DPA externally.

For 2027 it will focus on monitoring the Strategic Plan, deciding more collegially on files under an expected reform of the DPA's organic law, and strengthening external cooperation (EDPB, international bodies, other regulators).

1.2 The General Secretariat

The General Secretariat provides horizontal support (HR, budget, IT, communication, legal) and substantive tasks such as certification, codes of conduct and breach/DPO notifications, with 2027 priorities including AI-driven efficiency tools and a modernised HR policy.

1.3 The Frontline Services

The Frontline Services, the DPA's point of entry for citizens, controllers and processors, handle information requests, assess complaint admissibility and pursue early resolution.

The management plan states that the Frontline Services will no longer systematically respond to every individual information request. Instead, they will prioritise making general information readily accessible. Pending legislative reform, the Frontline Services will also gain new powers to dismiss files and manage reports.

1.4 The Authorisation and Advisory Service

The Authorisation and Advisory Service issues opinions on draft legislation, recommendations and certain statutory authorisations (e.g. access to communications metadata, cross-border data flow arrangements).

1.5 Inspection Service

The DPA's organic law describes the Inspection Service as the DPA's "investigative body".

Under the DPA's organic law, the Inspection Service has an extensive arsenal of investigative powers, from written questionnaires to on-site investigations, hearings, consultation of IT systems, and seizure and sealing of goods and systems. It is composed of inspectors with diverse profiles - lawyers, auditors, and ICT and information security experts - headed by the Inspector General, allowing a multidisciplinary approach that is not limited to a purely legal perspective.

Beyond its general inspection mission, it also carries out a specific audit function. The two are fundamentally different: an audit is a softer, cooperative control combined with coaching, carried out in consultation with the controller to reveal process weaknesses, while an inspection is a more formal investigative exercise. Audits generate significant workload and are expected to keep growing in importance as new large-scale, interoperable EU databases are developed.

The Inspection Service’s work is guided by the Strategic Plan 2026-2028's balanced, proportionate and effective approach, weighing the nature, seriousness and impact of each violation, with enforcement aimed first at ending violations of significant societal interest. Furthermore, it is moving towards a more proactive approach: controls will increasingly be initiated on the DPA's own initiative rather than driven mainly by complaints, with greater resources directed to strategic, high-impact files. This shift comes against explicitly flagged challenges, including rising case volumes and complexity and an announced recruitment freeze decided by Parliament. In response, the Strategic Plan emphasises reforming the internal complaint-handling chain to distribute files more rationally between the Frontline Services, the Inspection Service and the Litigation Chamber.

The Inspection Service remains convinced that the inspection phase is itself a guidance tool: investigative steps such as questionnaires, hearings, on-site visits or audits often prompt greater compliance even while the investigation is ongoing. To minimise the service's growing workload, increased use is made of dismissal after regularisation during the investigation (classement sans suite - seponering), which can benefit the complainant, the controller and the DPA alike, and relieves the Litigation Chamber from issuing a final decision - though the traditional route of a full investigation report referred to the Litigation Chamber remains available for files that warrant it.

The Inspection Service intends to explore transforming this inspection-stage dismissal into a kind of formal notice through legislative change, and is preparing the possibility of concluding settlements in inspection files - both developments depend on the timing of the planned reform of the DPA's organic law.

Finally, the Inspection Service will maintain constant vigilance on several topics such as the role of the DPO (still seen as a key actor, with room for improvement on designation, positioning and resourcing), on data brokers (given the complexity and opacity of their processing, flagged in the Strategic Plan), and on large-scale processing by public authorities, which can be particularly sensitive.

1.6 Litigation Chamber

The Litigation Chamber enforces data protection rules in cases brought before it - on the basis of a citizen's complaint, following an inspection, or through the GDPR's one-stop-shop mechanism for cases referred by other EU regulators. It has an autonomous role within the DPA but is not isolated: its priorities and approach are discussed with the DPA's other departments, in particular the Executive Committee.

Its tools include corrective measures and administrative fines, applying a "shortened procedure" for simpler cases and giving particular attention to the Internal market information system (IMI) procedure for cross-border cases with significant impact.

As the Litigation Chamber does not act on its own initiative but depends on the cases referred to it, it bases its assessment on the priorities set out in the Strategic Plan and other DPA strategic documents. Its dismissal policy includes negative priorities (classement sans suite - seponering), but it also applies positive priorities under which a case's societal impact plays a decisive role, with particular focus on the Strategic Plan's two priority themes.

To cope with a significant influx of complaints, a change process launched by the DPA will continue in 2027: earlier-stage handling of complaints within the Frontline Services, combined with a streamlined internal litigation chain, is expected to significantly reduce the influx of files reaching the Litigation Chamber.

Other 2027 priorities include processing cases more efficiently (including shorter decisions and greater use of administrative fines where appropriate), updating strategic notes (on dismissal, publication, penalty payments, fines and third-party involvement), developing a vade-mecum and knowledge database, and cooperating with other EU regulators and the EDPB on the one-stop-shop mechanism and cross-border cases under Articles 60 and 65 GDPR.

Act on awareness before enforcement follows: Given the DPA's circular approach, engaging with its guidance, recommendations and sector-specific awareness initiatives now is the most effective way to reduce the risk of becoming the subject of a proactive investigation once a theme moves from the information strand to the enforcement strand.

We encourage data controllers to monitor DPA recommendations and EDPB guidance closely, document their compliance efforts, and address any gaps identified before an inspection is triggered.

Our Lydian Information & Communication Technology (ICT) and Information Governance and Data Protection (Privacy) teams are available to assist you with any questions you may have regarding the latest developments in the field of data protection. Please feel free to reach out to us for further assistance.