繁 简 Port Eng
A A A
A A A
繁 简 Port Eng
Home
General notification
  • The Office for Personal Data Protection (hereafter as the GPDP) accepts and handles notifications of personal data processing, free of charge, that are governed by the Personal Data Protection Act (hereinafter as the PDPA).
  • A notification should be made by the data controller.
  • First, please make sure that data processing requires a notification to the GPDP instead of an authorization issued by the GPDP. In the latter case, please proceed to the application for authorization.
  • All the required information specified in Article 23 of the PDPA should be submitted with a notification, and the data controller should submit the paper form of the Notification Form for Personal Data Processing - First Application. Please note that this should be completed in Chinese or Portuguese, and one notification form is required for each data processing that intended to serve one single purpose or several related purposes. Please use separate forms for separate notifications should the processing involve a number of unrelated processing purposes.
  • If a simplified notification could be adopted for the notification obligation of a data processing, the data controller could submit the paper form of the Simplified Notification Form - First Application. The valid period is three years from the date when the GPDP completed the concerned registration. Please renew a notification with a Simplified Notification Form – Renewal or Update or Cancellation.
  • Confirm the details on the form are correct. If an application is submitted by a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its representative according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the representative of the entity according to that on his ID copy, in addition to submitting the required document copies as specified on the form.
  • A completed and signed form could be submitted to the GPDP through:

    a. in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The submission date will be regarded as the date of notification.

    b. by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The date of postmark will be regarded as the date of notification.

  • An applicant should supply further documents as soon as he or she is required by the GPDP.
  • The GPDP shall inform the applicant result by official letters. The notification will be, according to laws, registered and made accessible by the public.
  • Failure to comply with the obligations to notify may constitute administrative or criminal offence(s).

General Notification

Except where simplified notification or exemption of notification is allowed in a situation, under the following four types of circumstances a data controller shall notify the GPDP.

  • Personal data processing by automatic means

    Article 21(1) of the PDPA
    The controller or his representative, if any, must notify the public authority in writing within eight days after the initiation of carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes.

    Businesses using computer to store customer data

    Shops installed surveillance camera system inside and outside the shop area

  • When a data subject is physically or legally incapable of giving his consent

    Article 21(5) of the Personal Data Protection Act
    When personal data are processed according to Article 7(3)(1), non-automatic personal data processing governed by Article 7(1) shall be notified to the GPDP.

    When a social service organization processes health data or other sensitive data of the elderlies for their health care services, if they cannot provide explicit consent, then the organization should notify the GPDP for the respective processing.

  • Obligation to notify the GPDP in regard to exemptions from providing information to data subjects

    Article 10(5)(3) of the PDPA
    When personal data are processed for statistical purposes or for the purposes of historical or scientific research, when the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law or administrative regulations, in which case notification to the public authority is required.

    Example A: When an academic organization for research has to process vast amount of personal data, but it was unable to efficiently provide the respective information to every data subject, or the cost of such provision is too high, then before the actual processing it should notify the GPDP.

    Example B: In cases where no actual business or transactions are taking place , and where property registration information are collected for business marketing purposes, and there exists good reasons to believe that it is impossible to provide the respective information to the data subjects, then a real estate agent should notify the GPDP.

  • Transfer of personal data to a location outside the Macao SAR

    Article 20(1) of the PDPA
    When a data subject has given his explicit consent to the transfer, or where one of the following conditions is met, a transfer of personal data to a destination in which the legal system does not ensure an adequate level of protection within the meaning of paragraph 2 of the preceding Article may be allowed on condition that the public authority is notified.
    (1) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject’s request;
    (2) the transfer is necessary for the performance or conclusion of a contract concluded or to be concluded in the interests of the data subject between the controller and a third party;
    (3) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise of defence of legal claims;
    (4) the transfer is necessary in order to protect the vital interests of the data subject;
    (5) the transfer is made from a register which according to laws or administrative regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, provided the conditions laid down in law for consultation are fulfilled in the particular case.

    When the network server of an organization locates outside the Macao SAR

    When an organization uses the application on a server locates outside the MSAR to process personal data

Address：Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau

Tel: (853)28716006

Fax: (853)2871 6116