BELGIUM'S ELECTRONIC EVIDENCE COOPERATION FRAMEWORK IN 2026

Author info

28/07/2026

A new Belgian draft Act and implementing Royal Decree are working their way through the legislative process, and the EU e-Evidence package is entering into force. Public Electronic communications operators active in Belgium have long been subject to two related but distinct obligations under the Electronic Communications Act of 13 June 2005 (ECA):

(i) The substantive duty to cooperate with authority requests to provide or freeze electronic evidence, and

(ii) The structural duty to set up and maintain a Justice Coordination Cell (JCC) to channel that cooperation.

This post sets out the existing JCC framework and provides an update on the e-Evidence legislation that is set to change and broaden it to service providers that before were not subject to these obligations.

THE EXISTING FRAMEWORK

WHO MUST COOPERATE?

Under the ECA, operators are required to respond to requests from competent authorities for the provision or freezing of electronic communications data. Whether it is to identify a subscriber, reconstruct a route, or obtain traffic records, the operator must respond and must do so through its JCC. Operators are defined under Article 2, 11° ECA as any person or undertaking providing:

(i) a public electronic communications network (PECN) or

(ii) a publicly available electronic communications service (PECS).

Note that private networks and services fall outside the scope of the cooperation obligation.

Operators can be divided into three broad categories, each having activities at different layers of the communications stack:

· Mobile Network Operators (MNOs): independent operators owning a complete telecom infrastructure (Proximus, Orange, Telenet are Belgian examples). Because they control the physical infrastructure, MNOs have access to the widest range of data: from subscriber identification to traffic records and real-time localisation.

· Mobile Virtual Network Operators (MVNOs): operators who lack their own radio infrastructure and instead use the networks of MNOs under commercial access agreements (e.g. Lyca Mobile, Mobile Vikings, VOO). Their data access is narrower, reflecting their position in the chain.

· Over-the-Top operators (OTTs)/Online Service Providers (OSPs): operators who offer services using publicly available internet without operating a network of their own (e.g. Telegram, Meta, Microsoft). Under the evolving EU regime, they will be the primary target of the e-Evidence instruments discussed in Part B below.

WHO ARE REQUESTING AUTHORITIES?

The cooperation obligation is not limited to a single authority, but rather includes an obligation for operators to work together with a variety of authorities: The ECA as interpreted by a Ministerial Circular identifies the following range of authorities entitled to request data:

· the judicial authorities,

· the intelligence and security services,

· the Missing Persons Unit of the Federal Police,

· the FSMA,

· the Belgian Competition Authority,

· the CCB,

· the inspection services of the FPS Economy, and

· for identification data only, the FPS Public Health and the Office of the Ombudsman for Telecommunications.

While all of the named authorities have the power to request data, the scope of data each may obtain varies. As such, in general the judicial and intelligence and security services are entitled to a broader range of data.

WHAT IS THE JUSTICE COORDINATION CELL?

The Justice Coordination Cell (JCC) is a mandatory department that each operator is required to establish to perform the activity of responding to authorities’ requests for electronic communication data. To ensure they can adequately complete their tasks, the ECA imposes some mandatory requirements. As such, the JCC must:

· Consist exclusively of persons holding a positive security advice, issued without administrative or individual warning, and not subject to a ministerial refusal by the Minister of Justice. Obtaining this clearance takes time and must not be overlooked in planning,

· Establish and maintain an internal procedure governing how official requests are handled, and provide the BIPT with statistical data upon request, including the number of requests received, the legal basis relied upon, and the action taken by the JCC,

· Ensure that all requests and accompanying information are treated as strictly confidential. Only JCC members may answer requests, and they are bound by a duty of professional secrecy.

Operators must also appoint a person responsible for the protection of personal data, distinct from the DPO role, to oversee lawful handling of requests. Operators may establish a joint JCC with other operators or outsource JCC functions, provided structural and clearance requirements are met. The JCC must be located in Belgium, and non-Belgian staffing is complicated in practice because members still require Belgian security clearance.

WHAT DATA MUST BE RETAINED AND FOR HOW LONG?

The cooperation obligation does not stand alone. It is paired with a data retention obligation: operators must retain certain categories of electronic communications data so that they can respond to authority requests.

The data categories that must be retained are set out in Articles 122 to 127 ECA. The legislation has been the subject of scrutiny by the Belgian Constitutional Court and is a prime example of rolling codification. It has been amended several times, leading to a chaotic amalgamation of data, retention periods and operators responsible for particular sets of data. Broadly speaking, the data can be subdivided into three functional tiers, by considering them from the perspective of the Code of Criminal Procedure (CCP).

Tiers	Data Type Examples
Identification data Article 46bis Code of Criminal Procedure:	Subscriber identity, technical identifiers, services, payment details
Observation and localisation data Article 88bis CCP	Traffic data, mast locations, IP traffic, route reconstruction, real-time observation
Interception data Article 90ter CCP	Content data and user account data linked to specific identifiers

HOW DO REQUESTS REACH THE JCC?

Requests reach the JCC through three distinct channels:

(i) Judicial authority requests for identification, observation, localisation, and traffic data are routed through TANK (Telecom And Network Knowledge), a centralised exchange platform administered by the CTIF (Central Technical Interception Facility) and managed by the NTSU (National Technical and Tactical Support Unit) of the Federal Police.

(ii) Requests from administrative authorities, such as the FSMA, the CCB, and the FPS Economy are submitted directly to the operator.

(iii) Interception requests under Articles 88bis and 90ter CCP follow a third route through the central interception infrastructure.

ANOTHER LAYER OF COMPLEXITY TO AN EXISTING COMPLEX FRAMEWORK

THE EU E-EVIDENCE PACKAGE: THE WIDER CONTEXT

The upcoming Belgian reform cannot be understood in isolation from broader EU-level developments regarding e-Evidence. On 12 July 2023, the European Union adopted a two-instrument package to modernise cross-border access to electronic evidence:

Instrument

Impact

Regulation (EU) 2023/1543

Introduces two new instruments:

(i) the European Production Order (EPOC), which compels a service provider (including providers of electronic communication services, hosting services, cloud services, social networks and market places) in another Member State to produce electronic evidence within ten days (or eight hours in emergencies), and

(ii) the European Preservation Order (EPRO), which requires evidence to be preserved by those same service providers for sixty calendar days pending a follow-up production order.

The Regulation is directly applicable and applies from 18 August 2026 in all Member States but requires substantial implementation work at the national level.

Directive (EU) 2023/1544

Requires every service provider offering services in the EU to designate a contact point within the EU, that receives, handles, and executes orders directed to the provider. The Directive's transposition deadline was 18 February 2026. This Directive has important interactions with the existing JCC framework.

Belgium missed the deadline for the transposition of the Directive. As of the data of this blogpost, the draft Act remains in the advisory process.

The EU registration portal through which service providers must notify their contact details to authorities is available at https://webgate.ec.europa.eu/cdb-sp-reg/home. The decentralised IT system built on the e-CODEX platform is the mandatory channel for transmitting orders under the Regulation from 18 August 2026. Whether every Member State's national gateway will be fully operational on that date remains to be seen.

THE BELGIAN DRAFT ACT ON E-EVIDENCE

On 16 January 2026, the Belgian Council of Ministers approved a draft Act and an implementing Royal Decree for submission to advisory bodies: “Voorontwerp van wet betreffende de contactpunten van bepaalde ondernemingen die zijn belast met het beantwoorden van de verzoeken om verstrekking of bevriezing van elektronisch bewijsmateriaal van de overheden”.

The draft Act goes beyond transposing the Directive: it also addresses aspects outside the Directive’s scope, calibrated to the operational needs of Belgian authorities (judicial authorities and intelligence and security services) and the existing ECA framework.

INTRODUCING CONTACT POINTS, AND THE NEW COORDINATION CELL

At the core of both the Directive 2023/1544 and the Belgian draft Act is the concept of a contact point. The draft Act operates at two levels. At EU level, every transnational service provider offering services in Belgium must designate one of two forms of contact point: a designated establishment or a legal representative, depending on where it is established. At domestic level, every provider in scope must establish a Coordination Cell to handle requests from Belgian authorities. These three forms are set out in the table below. The first two are alternatives, not cumulative obligations.

Contact point	Description	Legal basis
Designated Establishment	A legal entity established in a participating EU Member State, appointed to receive and execute requests for electronic evidence in cross-border criminal proceedings. A Belgian establishment does not automatically qualify: designation must be explicit and contact details must be notified to the BIPT within five working days. The designated establishment must be adequately resourced to receive and execute orders, and execution at the Belgian level runs through the provider's Coordination Cell.	Art. 3 draft Act. Required where the provider is established in Belgium (or another participating MS) with legal personality.
Legal Representative	A natural or legal person appointed to serve the same function as the designated establishment, for providers established in a non-participating MS or with no EU establishment.	Art. 4 draft Act. Notification of contact details to BIPT within five working days of designation.
Coordination Cell (“Coördinatiecel”)	The contact point for requests from competent Belgian authorities (including outside criminal proceedings). The Coordination Cell must: · be established in Belgium for MNOs, full MVNOs, and providers with a Belgian establishment receiving judicial/intelligence requests (Art. 10, §1). · have members holding a positive security advice (Art. 10, §2). Notification to BIPT under Art. 11, §1. · have its contact details notified to the BIPT before becoming operational. · Transnational providers may designate their designated establishment or legal representative simultaneously as their Coordination Cell for Belgian domestic requests, avoiding a dual structure.	Art. 9 draft Act, which repeals and replaces the current art. 127/3 ECA.

For existing PECN/PECS operators, the practical impact is more limited than it may appear. The Coordination Cell fulfils the same function as the current JCC and must meet the same core requirements: Belgian location for MNOs and full MVNOs, security clearance for members, and BIPT notification. The substantive obligations, responding to authority requests and retaining data, are unchanged. The main additions are a codified BIPT notification requirement, the option to use the Coordination Cell as the EU-level contact point, and alignment with the cross-border order framework under the Regulation once it applies.

WHAT DOES THE DRAFT ACT ADD FOR SERVICE PROVIDERS NOT PREVIOUSLY IN SCOPE?

The contact-point structures described above apply to a broader range of providers than the existing ECA framework. For existing PECN/PECS operators, the Coordination Cell replaces the JCC with substantively preserved requirements. For service providers not previously in scope, the picture is different. The draft Act defines "service provider" to cover:

(i) electronic communications services,

(ii) internet domain name and IP numbering services, and

(iii) other information society services that enable users to communicate with each other or that store or process data on users’ behalf.

The novel definition brings services within scope that were not previously considered public or private electronic communications services or public electronic communications networks. Important additions are hosting providers, private messaging platforms, cloud services, and online marketplaces.

For these entities, both the obligation to appoint an EU-level contact point and to set up a Coordination Cell for Belgian authority requests apply as entirely new compliance requirements. National service providers, those established in Belgium offering services exclusively in Belgium, are subject only to the obligation to set up a Coordination Cell, and do not need to designate an EU-level contact point.

THE DRAFT ROYAL DECREE

The companion of the draft Act is the draft of a Royal Decree that operationalises the draft Act. It regulates primarily the transmission of contact details of the legal representative, the designated establishment, or the Coordination Cell, to the BIPT.

This Royal Decree is expected to replace and consolidate two existing Royal Decrees that currently govern the procedural modalities of the cooperation obligation: the Royal Decree of 9 January 2003 (judicial requests) and the Royal Decree of 12 October 2010 (intelligence and security service requests), both of which will be largely repealed.

CONCLUSION

The Belgian e-Evidence framework is in transition. The existing obligations under the ECA, the duty to cooperate, the JCC structure and the data retention regime all remain fully in force. At the same time, the draft Act and its implementing Royal Decree will, once adopted, extend the contact-point obligation to a broader range of service providers, and restructure the JCC as Coordination Cell. The combined effect of the (i) existing ECA framework, (ii) the upcoming Belgian implementation Act, and (iii) the directly applicable Regulation (EU) 2023/1543, creates a layered compliance challenge that providers should begin addressing now. Most urgently, the Regulation applies from 18 August 2026: providers not yet registered as an addressee via the EU Commission's notification portal should do so without delay.

GETTING ADVICE

Timelex regularly advises operators and service providers on the Belgian electronic communications framework, the JCC obligation, and the evolving e-Evidence regime. Not sure whether the new Coordination Cell obligation reaches your organisation? We run a focused scoping check that tells you whether you are a PECN/PECS operator, an in-scope service provider, or out of scope. You can reach Pedro Demolder at pedro.demolder@timelex.eu or Lotte De Graeve at lotte.degraeve@timelex.eu.

Pedro Demolder is a senior associate and Lotte De Graeve is associate at Timelex. They specialise in cybersecurity Act and NIS 2 compliance.

This post reflects the state of the Act and draft legislation as of June 2026. The Belgian draft Act and Royal Decree have not yet been finalised and may be amended before adoption.