個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Services
Print
Services
Updated:2017/10/18   
Notification to the Office for Personal Data Protection
  1. The Office for Personal Data Protection (hereafter as the GPDP) accepts and handles notifications of personal data processing, free of charge, that are governed by the  Personal Data Protection Act (hereinafter as the PDPA).
  2. A notification should be made by the data controller.
  3. First, please make sure that data processing requires a notification to the GPDP instead of an authorization issued by the GPDP. In the latter case, please proceed to the application for authorization.
  4. All the required information specified in Article 23 of the PDPA should be submitted with a notification, and the data controller should submit the paper form of the Notification Form for Personal Data Processing - First Application (to download), or filling in the form online.  Please note that this should be completed in Chinese or Portuguese, and one notification form is required for each data processing that intended to serve one single purpose or several related purposes. Please use separate forms for separate notifications should the processing involve a number of unrelated processing purposes.
  5. If a simplified notification could be adopted for the notification obligation of a data processing, the data controller could submit the paper form of the Simplified Notification Form - First Application (to download) or filling in this form online. The valid period is three years from the date when the GPDP completed the concerned registration. Please renew a notification with a Simplified Notification Form – Renewal or Update or Cancellation (to download).
  6. Confirm the details on the form are correct. If an application is submitted by a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its representative according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the representative of the entity according to that on his ID copy, in addition to submitting the required document copies as specified on the form.
  7. A completed and signed form could be submitted to the GPDP through:
    1. in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The submission date will be regarded as the date of notification.
    2. by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The date of postmark will be regarded as the date of notification.
  8. An applicant should supply further documents as soon as he or she is required by the GPDP.
  9. The GPDP shall inform the applicant result by official letters. The notification will be, according to laws, registered and made accessible by the public.
  10. Failure to comply with the obligations to notify may constitute administrative or criminal offence(s).
top

Application for Authorization
  1. The Office for Personal Data Protection (hereafter as the GPDP) accepts and handles applications free of charge in accordance with the Personal Data Protection Act (hereinafter as the PDPA).
  2. An authorization application should be made by acontroller.
  3. Before applying, please first refer to the authorization section and to confirm the types of authorization needed.
  4. Note: no processing of the personal data that requires prior authorization is allowed before obtaining an authorization from the GPDP; otherwise it may constitute an administrative or criminal offence. 
  5. An authorization application should include all the required information as specified in Article 23 of the PDPA. An applicant should submit a completed Application Form for Authorization  (to download). This form shall be completed in Chinese or Portuguese; separate application forms are needed for separate applications.
  6. Double check the details of the completed form. If an applicant is a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its representative according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the representative of the entity according to that on his ID copy as attached, in addition to submitting the required documents as specified on the form.
  7. Submitting the completed and signed form, together with the attached documents, to the GPDP can be done by the following methods:
    1. To submit in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The submission date will be regarded as the date of notification.
    2. To submit by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). Then the date of posting will be regarded as the date of notification.
  8. An applicant should supply further documents as soon as he or she is required by the GPDP.
  9. The GPDP shall inform the applicant of the result in writing. The authorization will be, according to laws, registered, made accessible by the public and published in GPDP’s annual report.
top

Application for Opinion
  1. The Office for Personal Data Protection (hereinafter as GPDP) accepts and handles applications for opinions free of charge, in accordance with the Personal Data Protection Act (PDPA).
  2. The application for opinions should be made by a controller.
  3. The application for opinions should be made in writing and submitted to the GPDP. The applicant should also, in accordance with Article 23 of the PDPA, provide the following information:
    1. name and address of the controller, and the name and address of its representative, if any;
    2. processing purpose;
    3. description of the type(s) data subjects and the type(s) of personal data or information concerned;
    4. the type(s) of data recipients or the type(s) of recipients to whom the data might be disclosed, as well as conditions of data disclosure;
    5. the entity entrusted with the data processing, if the controller does not process the data;
    6. data combination during personal data processing, if any;
    7. preservation period of personal data;
    8. ways and conditions with which the data subjects to be informed of or to rectify their personal data;
    9. proposed transfers of data to third countries; and
    10. a general description enabling a rudimentary assessment on the adequacy of the security measures for data processing under Articles 15 and 16 of the PDPA.
  4. If documents are attached, they must be listed clearly and attached with the letter of application in order.
  5. Double check the details of the completed form. If an applicant is a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its person in charge according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the personal in charge of the entity according to that on his ID copy as attached, in addition to submitting the required documents as specified on the form.
  6. Submitting the completed and signed form to the GPDP can be done by the following methods:
    1. To submit in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    2. To submit by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
  7. An applicant should supply further documents as soon as he or she is required by the GPDP.
  8. The GPDP shall inform the applicant of the result in writing. The opinions given will be, according to laws, made accessible by the public and published in the GPDP’s annual report.
top

Exercise of the Right of Access through the GPDP
  1. The Office for Personal Data Protection (hereinafter as the GPDP) accepts and handles applications, free of charge, for exercising the right of access through the GPDP as given in the Personal Data Protection Act (PDPA).
  2. Only a data subject can apply, and his application should only involve the personal data processing for the purpose of journalism, arts or literature.
  3. The data subject should clearly indicate that it is his request or his wish to exercise the right of access in order to obtain the concerned information.
  4. The data subject should fill in the specialized form (to download) for exercising the said right.
  5. After confirming the information on the form is correct, the data subject should sign the form in accordance with the signature on his ID, of which a copy should be provided.
  6. Submitting the completed and signed form to the GPDP can be done by the following methods:
    1. To submit in person (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    2. To submit by post (Address: P.O Box 880, Macao; or the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
  7. An applicant should supply further documents if being required by the GPDP.
  8. The GPDP shall inform the applicant of the result in writing.
top

Consultation
  1. The Office for Personal Data Protection (hereafter the Office) accepts and handles applications free of charge for consultation related to personal data processing.
  2. Prior to accessing personal data, please first read the related “Personal Data Collection Statement”.
  3. Consulting Methods:
    1. Come to the Office in person (address: at Av. da Praia Grande, No. 804, Edf. China Plaza, 13.º Andar, A-F, Macao);
    2. Mail the written request, to either P.O Box 880, Macao or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao;
    3. Fax the written request to the Office (Fax No.: 28716116);
    4. Email the request to: info@gpdp.gov.mo Please note: If you send the request via the open network, you run the risk of it being seen or used by unauthorized third parties.
    5. Make an enquiry with this website.
    6. Make a call to this Office (Tel. No.: 28716006).
  4. To respond to the consultation involving a particular data processing operation, the Office may ask the applicant to follow up the consultation in writing or by presenting himself in person and provide documents to prove that he is the data subject or controller. Though this is not obligatory, refusal to do so may affect response from the Office to the consultation.
  5. To respond to the consultation, the Office may ask the applicant to provide information related to that particular data processing. Though this is not obligatory, refusal to do so may affect response from the Office to the request.
  6. If the request involves application for opinion, the Office may ask the applicant to apply.
top

Complaints
  1. The Office for Personal Data Protection (hereafter the Office) accepts and handles complaints related to personal data processing free of charge in accordance with the Personal Data Protection Act. If the object of the complaint is the Office itself, it shall be handled through the usual public administrative complaint procedure.
  2. Prior to lodging the complaint, please first read the related “Personal Data Collection Statement”.
  3. Methods:
    1. Come to the Office in person (address: Av. da Praia Grande, No. 804, Edf. China Plaza, 13.º Andar, A-F, Macao);
    2. Mail the written complaint, either to P.O Box 880, Macao or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao;
    3. Fax the written complaint to the Office (Fax No.: 28716116);
    4. Email the written complaint to: info@gpdp.gov.mo Please note: If you send the request via the open network, you run the risk of it being seen or used by unauthorized third parties.
    5. File a complaint with this website.
    6. Make a call to this Office (Tel. No.: 28716006).
  4. To handle the complaint, the Office may ask the complainant to provide related personal data, either in writing and/or coming to the Office in person, to follow up the case and provide evidence to prove that he/she is the data subject of the data being processed. Though this is not obligatory, refusal to do so may affect the handling of the complaint by the Office.
  5. To handle the complaint, the Office may ask the complainant to provide information related to that particular personal data processing. Though this is not obligatory, refusal to do so may affect the handling of the complaint by the Office.
  6. If the complainant objects the GPDP to provide his information to the complainee(s) or other authorities or entities, he should specify clearly in his complaint. But this may affect the GPDP to handle the complaint.
  7. If the GPDP decides to carry out an investigation for the complaint, an administrative offence investigation (processo) will be initiated. Official language (Chinese or Portuguese) will be used when handling the complaint or making reply to the complainant.
  8. According to Article 14 the PDPA, the party suffering any damages caused by unlawful processing of personal data or other violation of laws and regulations about personal data protection can take civil proceedings of reparation against the entity responsible for the data processing.  The handling of complaint by the GPDP will not affect the prescribed period for the related legal proceedings.
top

The Personal Data Processing Register
              In accordance with Article 25 of the Personal Data Protection Act, the notifications and authorizations for personal data processing shall be registered on the GPDP’s database for public access.
             An online Register has been set up on the GPDP's website for checking the registered personal data processing. On the other hand, complete and submit the Application Form for Checking the Personal Data Processing Register (to download) to the GPDP personally (address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao) or send it by post (postal address: P.O Box 880, Macao; or the Office for Personal Data Protection, Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The GPDP will inform the register in writing.
top

Application for PDPA Seminar
  1. The Office for Personal Data Protection (hereafter as the GPDP) provides seminars on the Personal Data Protection Act (PDPA) to private and public institutions free of charge. 
  2. Seminars can be co-organized or jointly organized by the GPDP, and the applicant institution should be one of the organizers. In other words, the GPDP is a co-organizer or will jointly organize the seminar.
  3. After completing the Seminar Application Form (to download), make sure the information filled in is correct. A completed form should be stamped with the institution seal and signed by the person in charge, before submitting to the GPDP by:
    1. personally visiting the GPDP (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    2. post (Postal address: P.O Box 880, Macao; or the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    3. fax (Fax number: 28716116).
  4. The PDPA seminar serves to highlight the basics of the Personal Data Protection Act. Therefore, it does not aim to explain or answer for specific cases. Likewise, no analyses or opinions are given for a specific case during the seminar. Should there be a need for enquiry or opinion on a specific case from the GPDP, an institution should submit an enquiry or an application separately.
  5. If the applicant institution has specific requirements for the seminar content or for the activity arrangement, it should specify clearly in the application form aforesaid.
  6. To facilitate the applications for seminars, the GPDP may require an institution to provide further information, including the nature, status of the participants, venue arrangement, and others. In addition, the GPDP will further discuss the activity arrangement with the applicant institution.
  7. Generally the GPDP will inform the institution of the final application result through an official letter.
top

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116