GDPR and board liability: when data protection becomes a governance risk

By Geert Somers and Melissa Merville – Timelex 

Preliminary remark: While this post draws on Belgian law as a concrete example, its analysis maps directly onto the EU frameworks that apply across all Member States. Belgium is nonetheless a particularly useful lens: the entry into force of Book 6 of the new Civil Code on 1 January 2025 abolished the quasi-immunity of the executing agent, a development with no equivalent in most other Member States. 

Can a board member be held personally liable when their company fails on data protection? Until recently, the question would have attracted little attention. The GDPR was treated as a compliance matter, the responsibility of legal, IT or the data protection officer, and as a risk that stopped at the company’s legal personality. That assumption no longer holds. 

Three things have changed. First, the GDPR has been in force long enough that regulators and courts now expect maturity rather than evidence of good intentions. Second, data incidents have become board-level events, because they interrupt operations, trigger customer claims and attract public attention. Finally, in Belgium, the entry into force of Book 6 of the Civil Code on 1 January 2025 has reshaped when an individual, including a director, can be sued directly for a failure in the performance of the company’s obligations. 

This also fits a wider pattern across the EU digital rulebook. Where NIS2 reaches directors directly, through explicit management duties, data protection reaches them indirectly, through governance and national civil law. The destination is increasingly the same.

Not every GDPR breach will make directors personally liable, but the question is this: at what point does a privacy failure stop being an operational compliance issue and become a failure of governance? This article explores that distinction, and why it matters for boards in practice. 

Why this question matters now 

The GDPR has applied since 25 May 2018. After eight years, supervisory authorities and courts no longer treat a missing register or an unassessed high-risk project as an early-stage shortcoming. The Regulation’s accountability principle requires the company to be able to demonstrate that it complies. A general assertion that compliance is managed somewhere within the organisation does not satisfy that obligation. The absence of evidence is, increasingly, treated as evidence of absence. 

Enforcement is no longer theoretical either. Public enforcement trackers now record thousands of fines and decisions across the EEA, spanning every sector and every size of organisation. Alongside regulatory action, civil litigation has matured. Under Article 82 GDPR, a claimant seeking compensation must establish three elements: an infringement, damage actually suffered, and a causal link between the two. The Court of Justice confirmed in Österreichische Post (C-300/21) that a bare infringement is not enough to found a claim. At the same time, the Court removed a defence on which many respondents had relied, holding that non-material damage need not cross any national “seriousness” threshold in order to be compensable. The result is a litigation environment in which modest individual claims are easier to bring and, in aggregate, harder to ignore. 

The supervisory agenda for 2026 reinforces the point. On 19 March 2026, the European Data Protection Board launched its Coordinated Enforcement Framework action for 2026 on compliance with the transparency and information obligations of Articles 12 to 14 GDPR, with 25 supervisory authorities across Europe contacting controllers through enforcement actions or fact-finding exercises. Coordinated exercises of this kind are precisely where immature governance becomes visible, because they test not what an organisation says about its compliance but what it can document. 

The most distinctly Belgian development, however, is Book 6 of the Civil Code. Until the end of 2024, a director acting as the company’s “executing agent” enjoyed a quasi-immunity: a contractual counterparty of the company could generally sue only the company, not the individual behind the decision, unless the fault also amounted to a criminal offence. Article 6.3, §2 of the new Civil Code abolished that shield with effect from 1 January 2025. A counterparty who suffers loss can now, in principle, bring a direct extra-contractual claim against the individual whose fault caused it, including a director. This does not turn directors into guarantors of the company’s compliance, and the company-law safeguards continue to apply. But it makes it considerably more difficult to assume that every data-protection claim will come to rest against the company’s legal personality. 

Three tracks of exposure (administrative, civil and criminal) 

It helps to keep three tracks of exposure distinct. The administrative track runs through the GBA/APD and its European counterparts: fines and corrective measures are addressed to the company, although governance failures increasingly colour the assessment. The civil track runs through Article 82 GDPR against the company and, for directors personally, through the duty of care under the Code of Companies and Associations and, since 2025, Article 6.3, §2 of Book 6. The criminal track is the least known and, in its current form, the most distinctly Belgian. 

The criminal track: a Belgian particularity 

Unlike most Member States, Belgium attached criminal sanctions to its GDPR framework legislation. Title 6 of the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data provides criminal fines for a series of infringements, including certain processing in breach of the core principles, non-compliance with orders of the GBA/APD and obstruction of its investigations. Criminal liability is personal by nature: where an offence can be attributed to an individual, including a director whose personal involvement is established, prosecution can reach that individual directly, alongside or instead of the legal person. Prosecutions remain rare in practice, but the track exists, and criminal fines are typically not insurable. It would take us to far to elaborate further on these aspects in this blogpost. 

Who is actually responsible? 

Responsibility for data protection is shared across an organisation, and confusion about where it sits is itself a source of risk.

The company, as controller 

The controller, meaning the entity that determines the purposes and means of processing, is the primary actor under the GDPR and the first line of legal responsibility. The obligation to put appropriate technical and organisational measures in place, and to demonstrate that they exist, rests on the company. A director is not personally liable merely because the company has committed an infringement. That basic allocation has not changed, and it is the starting point for everything that follows. 

It is worth being precise about the mechanism. Article 82 GDPR, which governs compensation, runs against the controller or processor, meaning the company itself. A director’s personal exposure therefore travels through national company law and, since 2025, through Book 6, not through the GDPR’s own liability provision. 

The processor 

Processors carry direct obligations of their own: on security, on acting only on documented instructions, on engaging sub-processors, and on assisting the controller with breaches and data-subject requests. Security in particular is a shared duty: Article 32 requires both controllers and processors to ensure a level of security appropriate to the risk. Outsourcing a processing activity does not outsource the responsibility for it. 

The data protection officer 

The DPO is one of the most widely misunderstood roles in the framework. The DPO advises and monitors but does not “own” compliance in the sense of setting the company’s risk appetite or making the business decisions. The GDPR deliberately protects the DPO’s independence: no instructions on how to perform the role, direct reporting to the highest level of management, and protection against dismissal or penalty related to its tasks. 

A DPO who is appointed, then ignored, under-resourced and ultimately blamed when something goes wrong does not represent a functioning governance model. Such a history tends, on the contrary, to demonstrate that the relevant risks were identified and not acted upon. 

Management and operational teams 

Management implements. IT, security, legal, HR, marketing, product and procurement each own a piece of the compliance system in practice. The board’s role is to know whether the system exists, whether it is resourced, and whether the risks that matter actually travel upward when they need to. 

The board 

Under the Belgian Code of Companies and Associations (WVV/CSA), directors must exercise their mandate with the care, skill and diligence of a normally prudent director. They are liable for decisions, acts or conduct that manifestly fall outside the margin within which a reasonable director would act, subject to the statutory caps and to the rules that also reach de facto directors. Applied to data protection, this means that the board is not required to operate the privacy programme. It must, however, be in a position to demonstrate that the programme is in competent hands, that material risks are escalated to it, and that identified gaps are addressed rather than allowed to persist. 

When could board members be exposed?

Not every GDPR issue belongs in the boardroom. A missed deadline, a one-off error, an isolated process failure, are ordinarily operational matters, and they remain so. What alters the position for directors is persistence: a problem that was known, flagged, raised again, and nonetheless left unresolved. That is the point at which an operational shortcoming begins to look like a matter the board ought to have addressed. The situations set out below are those in which that threshold is most often reached. 

A known risk is ignored 

The DPO, the CISO, external counsel or an auditor flags a serious gap. The warning is repeated and recorded in the minutes, yet no action follows. Then a breach, complaint, investigation or customer claim arrives. The exposure in this scenario arises not from the original gap but from the documented decision to tolerate it. This is a particularly serious situation for a board, because the evidence of inaction already exists in writing. 

No governance for high-risk processing 

The company processes sensitive data, monitors employees, profiles individuals at scale, uses children’s data, or feeds personal data into AI tools, but there is no clear owner, no impact-assessment process and no escalation route. Article 35 GDPR requires a data protection impact assessment precisely where processing is likely to result in a high risk to individuals’ rights and freedoms. The absence of any process to identify and assess those activities is itself the governance failure. 

Security treated as an IT matter alone 

Article 32 makes security a data-protection obligation: appropriate measures, confidentiality and integrity, availability and resilience, the ability to restore access after an incident, and regular testing of the whole. When security is parked entirely with IT and never surfaces at board level, cybersecurity becomes the most concrete and most frequently tested expression of weak privacy governance. 

Vendor and sub-processor chains left uncontrolled 

Processing now runs through cloud, SaaS, payroll, analytics, outsourced IT and, increasingly, AI vendors. The European Data Protection Board has been clear that a controller relying on processors and sub-processors must remain able to obtain sufficient information about, and retain control over, the processing chain. A processing chain for which no one within the organisation retains responsibility is one that the organisation will struggle to defend. 

Contractual assurances that do not match reality 

A company executes data processing agreements, security schedules and customer commitments stating that appropriate controls are in place, while the internal reality differs. It is here that Book 6 is most directly relevant. Where a counterparty suffers loss and contends that the individuals involved in performing the contract committed an extra-contractual fault, the abolition of the auxiliary’s quasi-immunity renders a direct personal claim more plausible than it would have been before 2025. The gap between what was promised and what existed is no longer a purely corporate problem. 

Pressure on the DPO 

Article 38 protects the DPO from dismissal or penalty for performing the role and guarantees direct access to top management. A DPO who is formally independent but in practice discouraged from raising difficult issues constitutes a governance weakness, one that is liable to reflect on those responsible for applying that pressure. 

What should boards ask? 

None of this requires directors to become privacy specialists. It requires them to put a limited number of precise questions to management and to assess the adequacy of the responses. The principal questions are set out below. 

• Do we know our highest-risk processing activities? Not every processing operation deserves board attention. The focus should be on what could create serious legal, operational, customer or reputational impact. 
• Is our DPIA process effective in practice? The real test is whether high-risk projects are genuinely paused or escalated until the risks have been assessed. 
• Are incidents escalated quickly enough? The board should know when a breach may trigger notification, customer escalation, litigation exposure or business interruption. 
• Is the DPO independent, resourced and heard? Reporting lines on paper are not equivalent to being listened to in practice.
• Are vendors and sub-processors under control? This covers cloud, SaaS, payroll, HR, marketing, analytics, AI tools and outsourced IT and security. 
• Is cybersecurity treated as a GDPR risk, rather than solely an IT matter? Article 32 makes security a core data-protection obligation. 
• Do our board minutes evidence oversight without creating unnecessary exposure? Evidence that the right questions were asked is valuable; a careless record can cut the other way. 
• Do our D&O, cyber and professional liability policies respond coherently? Exposure is only as well managed as the insurance behind it. 

Conclusion 

A GDPR infringement does not, in itself, create personal liability for directors. Most GDPR obligations fall on the controller or the processor, and compensation under Article 82 still requires damage and causation, as the Court of Justice has confirmed. Nor does Book 6 turn directors into insurers of every operational error. The increased exposure is real, but it is also tempered by the company-law safeguards and by the defences a director can draw from the company’s own contracts. 

The risk lies in a narrower place: where a data-protection failure reveals that known risks were ignored, that no adequate governance was in place, or that contractual commitments were made which the organisation could not meet. In each of those situations, the issue is not really about data protection. It is about how the company was governed. 

Boards are not required to manage the privacy programme themselves. They are, however, required to satisfy themselves that it exists, that it is adequately resourced, that serious risks are brought to their attention, and that their decisions are properly documented. In the current Belgian liability environment, evidence of oversight may carry as much weight as evidence of compliance. 

One question to ask yourself today 

If you would like a practical assessment of your organisation's privacy governance, DPO positioning and the documentation that evidences oversight architecture looks like for your specific sector and structure, Timelex would be glad to help. You can reach Geert Somers(geert.somers@timelex.eu) or Melissa Merville (melissa.merville@timelex.eu).

Geert Somers is a founding partner at Timelex and co-leads the firm's digital regulation and cybersecurity practice. Melissa Merville is an associate at Timelex specialising in data protection, privacy and cybersecurity law.

This post reflects EU and Belgian law as it stood in June 2026 and is intended as general legal information. It does not constitute legal advice for any specific situation.