Protecting Ethical Hackers Under Belgian Law ' And How Organisations Should Respond To Vulnerabilities Disclosed To Them

• Published date: 01 December 2025
• Subject Matter: Privacy, Technology, Data Protection, Security
• Law Firm: Timelex
• Author: Mr Janvier Parewyck and Seliha Buelens

This blog article is available in English, French and Dutch.

The security of IT systems and the data they contain is becoming increasingly crucial for businesses and public institutions, to the point of becoming a political priority in the face of what are now global and sometimes state-run IT threats. From a legal point of view, security requirements are increasing exponentially (particularly since the GDPR, the Cybersecurity Act, the NIS2 and CER directives, the CRA and DORA regulations, etc). It is in these circumstances that the Belgian legislator has chosen to confer a special protection regime on ethical hackers.

Ethical hackers are cybersecurity specialists who use their hacking skills to identify vulnerabilities in computer systems and communicate them to the organisation concerned before they can be exploited by malicious hackers ("black hat hackers").

Organisations (both companies and public institutions) can hire such specialists and auditors, either internal or external, to carry out penetration tests ("pentest") to search for, discover and correct vulnerabilities and improve the security of their systems.

Another interesting opportunity for organisations is to take advantage of the spontaneous intervention of certain ethical hackers - individuals who, autonomously and without prior contact, identify vulnerabilities and decide to report them responsibly. Owing to their sheer number and the diversity of their skills, these ethical hackers can sometimes bring to light previously unnoticed vulnerabilities, and should therefore be seen as a valuable additional lever in any cybersecurity strategy.

However, historically, (attempted) intrusion into a computer system may be punishable under criminal law if the ethical hacker has not received prior authorisation - which is of course a significant barrier. To overcome this challenge, some organisations choose to adopt a Coordinated Vulnerability Disclosure Policy (or "CVDP") explicitly authorising ethical hackers to test their systems under certain conditions, or even Bug Bounty programmes designed to encourage the search for and reporting of such vulnerabilities. In some cases, implementing such a policy is a legal requirement.

Furthermore, even if the organisation does not have a CVDP in place, or if the ethical hacker acts beyond the CVDP, the Belgian legislator has chosen to grant special legal protection to ethical hackers in order to prevent them from exposing themselves to criminal prosecution when pursuing a "noble cause". This way, ethical hackers can report vulnerabilities without fear of reprisals.

This blog post will first focus on this protective regime and its conditions of application, before looking at the obligations of organisations that are notified of vulnerabilities.

1. Protection from criminal prosecution

The protection regime is conferred by the Belgian law of 26 April 2024. This law transposes the NIS2 directive, but it is not...