Evolving regulatory expectations - the new Belgian private investigation act | Roundtable takeaways

Context and background

The Wet Private Opsporing (WPO), published on 6 December 2024, replaces Belgium's 30-year-old Detective Act. It introduces a modern, GDPR-aligned framework for private investigation that is sector-neutral, meaning it applies equally to external detective agencies and to in-house functions such as Internal Audit or HR when they conduct targeted investigations.

What Counts as 'Private Investigation'?

Article 3 defines private investigation through four cumulative conditions. All four must be met simultaneously:

⚠ Important for Internal Audit

If a company systematically routes all fraud-related cases through the whistleblowing channel and then Internal Audit proceeds to investigate, this systematic approach in itself brings the activity within the scope of the WPO. The whistleblowing channel is not a blanket exemption from private investigation law. The determining factor is not the intake channel, but the nature and purpose of the investigation that follows. As soon as the four cumulative conditions of Article 3 are met — regardless of how the case entered the system — the WPO applies in full, including all nullity risks under Article 101.

Articles already in force: act now

While many implementing decrees are pending, the following provisions are legally active today and carry nullity sanctions:

Whistleblowing Channel - a special regime

When a case originates through the whistleblowing (WB) channel, the legal framework shifts:

• The 'client' under the WB Act is the legislator (not the company), aimed at protecting the reporting individual.
• Belgian law added two specific topics to the WB scope: social fraud and financial fraud.
• For these two categories, IA can investigate without requiring an IBZ investigator license, but must still comply with GDPR and WPO.
• GDPR compliance means: if you wish to use the gathered information, you must inform the investigated person and grant them access to their personal data.
• If IA systematically routes all investigations through the WB channel, it must be prepared to comply with all notification and data-access obligations this entails.

⚠ Important for Internal Audit

If a company systematically routes all fraud-related cases through the whistleblowing channel and then Internal Audit proceeds to investigate, this systematic approach in itself brings the activity within the scope of the WPO. The whistleblowing channel is not a blanket exemption from private investigation law. The determining factor is not the intake channel, but the nature and purpose of the investigation that follows. As soon as the four cumulative conditions of Article 3 are met — regardless of how the case entered the system — the WPO applies in full, including all nullity risks under Article 101.

ACFE Belgium Position - IA vs. Forensic Investigation

ACFE Belgium and IFA have submitted a position paper. Key arguments relevant to Internal Audit:

• Routine IA work (risk assessments, controls, fraud indicators) is OUT of scope of WPO.
• Targeted investigations into individuals with evidence collection and confrontational interviews ARE in scope.
• ACFE Belgium advocates for clear escalation guidelines: at what point must IA refer a matter to a licensed forensic investigator?
• Recommended best practice (two-phase approach): preliminary investigation under whistleblower legislation → follow-up investigation under WPO if all four cumulative criteria are met.
• IT forensic specialists providing purely technical support under a licensed investigator's instruction do not need their own WPO license. However, if they help determine the investigation direction or report directly to the client, the WPO applies.

This article reflects a professional reading of the Private Investigations Act and is intended for informational and discussion purposes. It does not constitute legal advice. Members are encouraged to seek independent legal counsel on matters of specific application.