DATA PROTECTION LAWS OF THE WORLD
REGISTRATION
REGISTRATION
In general terms, depending on the type of personal data
and on the purposes of the processing either:
The OPDP must be notified of any processing of personal
data by a data processor unless an exemption applies.
prior notification to APD, or
prior authorisation from the APD,
is required. Please note that in the case of authorisation,
compliance with specific legal conditions are mandatory.
The APD may exempt certain processing from the
notification requirement. In general terms, notification and
authorisation requests should include the following
information:
the name and address of the controller and of its
representative (if applicable)
the purposes of the processing
a description of the data subject categories and
the personal data related to those categories
the recipients or under which categories of
recipient to whom the personal data may be
communicated and respective conditions
details of any third party entities responsible for
the processing
the possible combinations of personal data
the duration of personal data retention
the process and the conditions for a data subject
to execute further rights of access, rectification,
deletion, opposition and updating
any predicted transfers of personal data to third
countries
For certain data categories (eg, certain sensitive personal
data, data regarding illicit activities or criminal and
administrative offenses or credit and solvency data) and
certain specific personal data processing, data processors
must obtain prior authorization from the OPDP.
The OPDP provides (official) forms that must be
submitted regarding personal data processing, either in
Portuguese or Chinese language, along with the following
information (if applicable):
Identification and contact details of the data
processor and its representatives
The personal data processing purpose
Identification and contact details of any third party
carrying out the personal data processing
The commencement date of the personal data
processing
The categories of personal data processed
(disclosing whether sensitive personal data, data
concerning the suspicion of illicit activities,
criminal and / or administrative offenses or data
regarding credit and solvency are to be collected)
The legal basis for processing personal data
The means and forms available to the data subject
for updating his or her personal data
Any transfer of personal data outside Macau, along
with the grounds for, and measures to be adopted
with, the transfer
Personal data storage time limits
Interconnection of personal data with third parties
Security measures adopted to protect the
personal data
a general description (which will allow the APD to
assess the suitability of the measures adopted to
ensure the processing security).
DATA PROTECTION OFFICERS
DATA PROTECTION OFFICERS
There is no obligation to appoint data protection officers.
There is no legal requirement to appoint a data protection
officer in Macau.
COLLECTION & PROCESSING
COLLECTION & PROCESSING
In general terms, personal data collection and processing
Personal data may be processed only if the data subject
3 | Data Protection Laws of the World | Angola vs Macau | www.dlapiperdataprotection.com