GDPR updates (November 2025): what changed and what to do next

November 2025 brought four substantive GDPR decisions from the Belgian Data Protection Authority (APD/GBA), focusing on access requests, marketing consent, and internal access controls.
Even though these are national decisions, the themes are broadly relevant for any organization operating in the EU: regulators expect evidence, operational readiness, and consistent execution—not just policies.

1) Right of access: acknowledging a request is not compliance (Decision 200/2025 – 28 Nov)

Decision No. 200/2025 deals with a right-of-access complaint in a recruitment context, where the complainant requested access to personal data held by two respondents (Y1 and Y2).
The decision stresses that controllers must provide a complete and timely response under Article 15 GDPR, and that simply acknowledging the request within the deadline is not enough if the data subject does not actually receive the relevant personal data and required information.
It also highlights that any restriction of access must be justified and proportionate, rather than treated as a default limitation.

Practical actions (DSAR / HR teams):

• Update DSAR playbooks to define what “complete response” means (data + contextual information), not just timeline compliance.

• Prepare recruitment-specific DSAR templates, including how to handle redactions and third-party data.

• Document the rationale for any limitation (why it applies, why it is proportionate, and how it was assessed).

2) Marketing consent: if it can’t be proven, it doesn’t exist (Decision 199/2025 – 27 Nov)

Decision No. 199/2025 addresses a case involving Infobel (a data broker) accused of processing personal data for direct marketing without valid consent.
The Belgian DPA emphasizes that controllers must obtain explicit, informed, and specific consent where required, and must be able to demonstrate a lawful basis and compliance (referencing GDPR principles and obligations including accountability).
The decision includes corrective measures (such as deleting data where no valid legal basis can be demonstrated and notifying recipients) and imposes a €40,000 administrative fine on Infobel.

Practical actions (Marketing / Growth / Legal):

• Audit consent evidence end-to-end: capture language, timestamps, purpose granularity, and proof retention.

• Reassess third-party data sourcing (brokers, enrichment providers, partners): ensure the chain of compliance is real and evidenced.

• Build an operational “fast path” for deletions, suppression lists (do-not-contact), and downstream notifications when the legal basis fails.

3) Unauthorized internal access: access controls and accountability still dominate (Decision 188/2025 – 19 Nov)

Decision No. 188/2025 concerns unauthorized access to the National Registry by employees within a municipal administration, following a complaint alleging improper access to personal data.
The decision underlines the need for adequate technical and organizational measures, emphasizing accountability and access control so that access is limited to authorized purposes and can be logged and justified.
It also notes that while individuals may be responsible for misuse, the overarching compliance responsibility remains with the controller to prevent and detect this through robust controls.

Practical actions (Security / IT / Compliance):

• Enforce least privilege and run periodic access recertifications for sensitive systems.

• Strengthen logging and monitoring so access to sensitive datasets is traceable and reviewable.

• Keep evidence of controls (reviews, logs, policy enforcement, incidents handling), not just written policies.

4) Decision 181/2025 (12 Nov 2025): Fixed CCTV cameras aimed at a right-of-way/access path

Decision No. 181/2025 relates to a complaint about the use of fixed surveillance cameras oriented toward a servitude/right-of-way area (i.e., an access path used by others). 
For organizations, it’s a practical reminder that CCTV compliance is not only about having cameras for “security”, but about controlling what is actually captured: the field of view must be scoped, the purpose and lawful basis must be documented, and transparency (signage/notices) plus retention discipline must be enforced—especially when third parties may be filmed. 
Official publication link: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-181-2025.pdf

If you’d like, Wyverton can help you translate these rulings into an actionable plan—DSAR process hardening, consent provenance audits for marketing, and access-control governance with logging and periodic reviews—so compliance is measurable and evidence-based