"Specific" Data Protection Laws Adopted Under Article 6.3 GDPR: Key Points On Their Drafting

• Published date: 03 December 2025
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Timelex
• Author: Mr Janvier Parewyck

In addition to the GDPR and national framework laws on the protection of personal data, many specific national laws impose or regulate certain data processing operations by public and private entities. These laws constitute the "legal basis" for processing within the meaning of the GDPR. Despite their abundance and the important source of obligations, rights and information they represent, there is little discussion of how they should be drawn up. Yet these laws must meet strict requirements. Drafting them often involves a delicate balancing act between, on the one hand, safeguarding the objectives of the GDPR and legal certainty and, on the other, the need to produce laws that are durable and sufficiently flexible. The quality of the drafting will be decisive for the subsequent implementation of the processing operations provided for therein.

This blog article provides an overview of the requirements and best practices in this area. It is aimed at public authorities and legislators who intend to introduce new data processing activities by public or private entities, as well as practitioners who would like to know more about these legal bases and how to deal with them.

The developments that follow are mainly based on experience gained in the drafting of Belgian legislation, but the principles set out should apply in a similar way throughout the Union, subject of course to the specific characteristics of each Member State.

1. When is a specific law required?

Article 6 of the GDPR sets out six legal bases for processing personal data. Most of these bases do not imply the intervention of the legislator, and therefore the existence of any law explicitly making the processing "lawful" within the meaning of the GDPR.

A private entity, or even a public entity, is therefore free to seek the consent of data subjects to process their data for specific purposes (Article 6.1.a of the GDPR).

Similarly, this entity may enter into contracts and invoke their performance to process data, for example employment contracts requiring the processing of workers' data (Article 6.1.b GDPR).

There is also a legal basis available where the processing aims to protect the vital interests of an individual, which is rarely used in practice (Article 6.1.d GDPR).

In addition, a private company is free to determine its "legitimate interests" and, provided it can demonstrate that the risks to data subjects are balanced, to process personal data for purposes in pursuit of its own interests (Article 6.1.f GDPR). In the latter case, the data subject must be informed, but in principle does not have to give his or her prior approval.

In all these cases, the legislator is under no obligation to intervene ex ante.

On the other hand, the legislator is required to intervene in two cases:

• It wishes to impose a legal obligation on data controllers, whether private or public entities (Article 6.1.c GDPR). For example, the legislator wants to require private companies to send certain information to the tax authorities.
• It wishes to entrust an entity (usually public, but sometimes private) with a task in the public interest or in the exercise of official authority, for which the processing of personal data will be necessary (article 6.1.e).

Article 6.3 of the GDPR provides that processing operations intended to be based on Article 6.1.c or 6.1.e must be clearly and precisely defined by national (or Union) law (see Recital 41).

It should be noted that, for public bodies carrying out their tasks, the legitimate interests basis of Article 6.1.f is in principle not available (although this provision is generally considered to refer only to their tasks as a public sector body, and not to any ancillary data processing activities that they may undertake). Consequently, except in cases where it is possible to base processing on consent, performance of a contract or vital interest, a specific law will be required.

In practice, the processing carried out by public authorities is mainly based on a specific law.

2. Content of the specific law: "Essential elements" to be defined

When the GDPR came into force in 2018, the content and precision that such laws should embody gave rise to many questions. Many processing operations continued (and still continue today) to be carried out on the basis of laws predating the GDPR.

Today, the requirements for precision and the criteria to be met by such specific law have been greatly clarified by the...