Belgian employers conducting internal workplace investigations must comply with the full procedural machinery of the Private Investigations Act (PIA) — including written assignment documents, consent-based interviews and a 30-day post-investigation decision window — even when their own HR staff run the probe.

That is the core message for people-process owners: an investigation into an employee is only lawful if the employer has a documented legitimate interest, set out in writing before the investigation begins, and if the possibility of investigating employees is expressly and transparently laid down in internal regulations. A hard deadline sits behind the regime: those internal regulations must be in place by 16 December 2026.

What must happen before an investigation starts?

The employer must record a legitimate interest in the results of the investigation in a written investigation assignment document before work begins — or in the assignment register, if the internal investigation service conducts it. An investigation into an employee is permitted only where internal regulations expressly and transparently allow it.

Which fields are off-limits?

The PIA prohibits investigators from gathering and disclosing information on:

• political opinions, religious, philosophical or ideological beliefs, and trade union or health insurance fund membership;
• genetic data, or biometric data used for unique identification;
• sexual behaviour or sexual orientation;
• health data;
• non-public suspicions, prosecutions, convictions, administrative sanctions or security measures;
• racial or ethnic origin; and
• court, tribunal and administrative disputes not yet publicly decided.

Indirect inference is barred too. An investigator may not hand the principal information from which those protected categories can be deduced without further intelligence.

What powers does the investigator actually have?

None beyond an ordinary citizen's. The investigator may perform only acts flowing from rights available to any person, supplemented by what the PIA expressly permits, and may not impede the rights and freedoms of investigation subjects. Evidence gathering must be adequate, relevant and not excessive relative to the private sphere of the persons concerned, and must stay within the agreed investigation result.

Entering a non-public place requires the written consent of the person who has actual enjoyment of that place, or their appointee. The PIA sets its own rules for observation, investigative techniques applied to goods and persons, and consultation of personal data in automated files not accessible to the public.

How must interviews be run?

An interview can only take place with the person's consent. The investigator must provide detailed information beforehand, and must refrain from any question, suggestion, threat or other act that could give the impression the person cannot answer freely.

Recording — image or sound — requires express information and prior consent, and the interviewee is entitled to a free copy. Capturing consent in the recording itself is advisable. Every interview must produce a written report.

An entrapment prohibition applies: the investigator may not induce a person to do something they would not have done on their own initiative. Using information obtained through an offence or otherwise unlawfully is prohibited, as is inciting others to obtain it.

What happens after the final report?

Once the final report is submitted, the principal must tell the investigator in writing, within 30 days, whether it intends to act on the information. Two scenarios follow:

• No follow-up. The principal may no longer use the information and must immediately destroy the interim and final reports. Nothing is communicated to the investigated person.
• Follow-up. The assignment holder must notify the data subject — and every other identifiable person whose data was processed — in writing and without delay. The principal may not use the information until those persons have exercised their rights.

Employers that want to keep a report as a possible starting point for a later investigation based on new facts should opt for the second scenario.

A written report, signed by the assignment holder and all investigators involved, must reach the principal no later than one month after the last investigative act. In urgent cases, oral reporting is allowed first, with a written report within eight working days. Findings must be lawful, accurate, adequate, relevant and limited to what is necessary. Disclosure to third parties is allowed only insofar as strictly necessary for defending the legitimate interests described in the assignment document; public disclosure is prohibited. The file must be kept for three years from transmission and then destroyed.

Does the HR exemption help?

Only partly. HR professionals carrying out investigative activities for their own employer, in an incident investigation concerning their own employees, do not need an identification card and are exempt from licensing requirements. Every other obligation under the PIA applies in full.

What is the exposure if the process fails?

Courts must verify that findings were obtained in accordance with the PIA and assess their evidential value. A court may attach no legal effect to findings where:

• the investigation was run by an unlicensed company or an investigator without a valid identification card;
• elements were obtained through the most serious PIA breaches, such as investigating prohibited fields or unlawfully obtaining findings; or
• notification requirements towards the data subject were ignored, or findings were used unlawfully.

Not everything is automatically tainted: where multiple methods established the same facts, one unlawful method does not contaminate findings independently supported by correctly applied methods.

Supervision sits with the Data Protection Authority, the police services and inspectors designated by Royal Decree. A sanctioning officer may issue a warning, propose a settlement or impose an administrative fine — and every official report establishing a GDPR infringement goes to the Data Protection Authority, whose full sanctioning arsenal also applies.

With the 16 December 2026 deadline for compliant internal regulations approaching, Belgian employers and multinationals with Belgian operations should now be auditing whether their investigation policies, interview protocols and file-retention practices match what the PIA demands.