Belgium

Technology Company

177,000 €

GDPR enforcement action by Belgian Data Protection Authority (APD) on 2026-05-12.

Rank · Sector

#18

of 212 in Employment

Rank · Belgium

of 50

Rank · All fines

#382

of 3,039

Case details

Authority: Belgian Data Protection Authority (APD)
Date: 2026-05-12
Controller / Processor: Technology Company
Sector: Employment
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Belgian DPA has imposed a fine of EUR 177,000 on a technology company. The controller failed to delete a former employee's email account, resulting in personal data being processed without sufficient legal basis. The controller only deactivated the email account after a certain period of time, which cannot be considered a deletion, which would have been necessary. Additionally, the controller failed to adequately inform the data subject regarding the processing.

Open original source Links to the regulator's original publication or another source.