個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Services
Print
Services
Updated:2021/02/22   
Notification to the Office for Personal Data Protection
  1. The Office for Personal Data Protection (hereafter as the GPDP) accepts and handles notifications of personal data processing, free of charge, that are governed by the  Personal Data Protection Act (hereinafter as the PDPA).
  2. A notification should be made by the data controller.
  3. First, please make sure that data processing requires a notification to the GPDP instead of an authorization issued by the GPDP. In the latter case, please proceed to the application for authorization.
  4. All the required information specified in Article 23 of the PDPA should be submitted with a notification, and the data controller should submit the paper form of the Notification Form for Personal Data Processing - First Application (to download), or filling in the form online.  Please note that this should be completed in Chinese or Portuguese, and one notification form is required for each data processing that intended to serve one single purpose or several related purposes. Please use separate forms for separate notifications should the processing involve a number of unrelated processing purposes.
  5. If a simplified notification could be adopted for the notification obligation of a data processing, the data controller could submit the paper form of the Simplified Notification Form - First Application (to download) or filling in this form online. The valid period is three years from the date when the GPDP completed the concerned registration. Please renew a notification with a Simplified Notification Form – Renewal or Update or Cancellation (to download).
  6. Confirm the details on the form are correct. If an application is submitted by a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its representative according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the representative of the entity according to that on his ID copy, in addition to submitting the required document copies as specified on the form.
  7. A completed and signed form could be submitted to the GPDP through:
    1. in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The submission date will be regarded as the date of notification.
    2. by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The date of postmark will be regarded as the date of notification.
  8. An applicant should supply further documents as soon as he or she is required by the GPDP.
  9. The GPDP shall inform the applicant result by official letters. The notification will be, according to laws, registered and made accessible by the public.
  10. Failure to comply with the obligations to notify may constitute administrative or criminal offence(s).
top

Application for Authorization
  1. The Office for Personal Data Protection (hereafter as the GPDP) accepts and handles applications free of charge in accordance with the Personal Data Protection Act (hereinafter as the PDPA).
  2. An authorization application should be made by a controller.
  3. Before applying, please first refer to the authorization section and to confirm the types of authorization needed.
  4. Note: no processing of the personal data that requires prior authorization is allowed before obtaining an authorization from the GPDP; otherwise it may constitute an administrative or criminal offence. 
  5. An authorization application should include all the required information as specified in Article 23 of the PDPA. An applicant should submit a completed Application Form for Authorization  (to download). This form shall be completed in Chinese or Portuguese; separate application forms are needed for separate applications.
  6. Double check the details of the completed form. If an applicant is a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its representative according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the representative of the entity according to that on his ID copy as attached, in addition to submitting the required documents as specified on the form.
  7. Submitting the completed and signed form, together with the attached documents, to the GPDP can be done by the following methods:
    1. To submit in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The submission date will be regarded as the date of notification.
    2. To submit by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). Then the date of posting will be regarded as the date of notification.
  8. An applicant should supply further documents as soon as he or she is required by the GPDP.
  9. The GPDP shall inform the applicant of the result in writing. The authorization will be, according to laws, registered, made accessible by the public and published in GPDP’s annual report.
top

Application for Opinion Relating to the Personal Data Protection Act
  1. The Office for Personal Data Protection (hereinafter as GPDP) accepts and handles applications for opinions free of charge, in accordance with the Personal Data Protection Act (PDPA).
  2. The application for opinions should be made by a controller.
  3. The application for opinions should be made in writing and submitted to the GPDP. The applicant should also, in accordance with Article 23 of the PDPA, provide the following information:
    1. name and address of the controller, and the name and address of its representative, if any;
    2. processing purpose;
    3. description of the type(s) data subjects and the type(s) of personal data or information concerned;
    4. the type(s) of data recipients or the type(s) of recipients to whom the data might be disclosed, as well as conditions of data disclosure;
    5. the entity entrusted with the data processing, if the controller does not process the data;
    6. data combination during personal data processing, if any;
    7. preservation period of personal data;
    8. ways and conditions with which the data subjects to be informed of or to rectify their personal data;
    9. proposed transfers of data to third countries; and
    10. a general description enabling a rudimentary assessment on the adequacy of the security measures for data processing under Articles 15 and 16 of the PDPA.
  4. If documents are attached, they must be listed clearly and attached with the letter of application in order.
  5. Double check the details of the completed form. If an applicant is a legal person or an entity with legal personality, the form should be stamped with an official seal and signed by its person in charge according to the signature of his ID documents. On the other hand, if the applicant is a natural person or an entity without legal personality then it is proved by the signature of the applicant or the personal in charge of the entity according to that on his ID copy as attached, in addition to submitting the required documents as specified on the form.
  6. Submitting the completed and signed form to the GPDP can be done by the following methods:
    1. To submit in person to the Office for Personal Data Protection (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    2. To submit by post (P.O Box 880, Macao; or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
  7. An applicant should supply further documents as soon as he or she is required by the GPDP.
  8. The GPDP shall inform the applicant of the result in writing. The opinions given will be, according to laws, made accessible by the public and published in the GPDP’s annual report.
top

Exercise of the Right of Access through the GPDP
  1. The Office for Personal Data Protection (hereinafter as the GPDP) accepts and handles applications, free of charge, for exercising the right of access through the GPDP as given in the Personal Data Protection Act (PDPA).
  2. Only a data subject can apply, and his application should only involve the personal data processing for the purpose of journalism, arts or literature.
  3. The data subject should clearly indicate that it is his request or his wish to exercise the right of access in order to obtain the concerned information.
  4. The data subject should fill in the specialized form (to download) for exercising the said right.
  5. After confirming the information on the form is correct, the data subject should sign the form in accordance with the signature on his ID, of which a copy should be provided.
  6. Submitting the completed and signed form to the GPDP can be done by the following methods:
    1. To submit in person (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    2. To submit by post (Address: P.O Box 880, Macao; or the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
  7. An applicant should supply further documents if being required by the GPDP.
  8. The GPDP shall inform the applicant of the result in writing.
top

Consultation
  1. The GPDP accepts and handles applications free of charge for enquiry, in accordance with the PDPA, related to personal data processing.
  2. Prior to filing an enquiry, please first read the related Personal Data Collection Statement.
  3. Enquiries can be made by:
    1. Personal visit (Address: Av. da Praia Grande, No. 804, Edif. China Plaza, 17.º Andar, Macau);
    2. Mail to P.O Box 880, Macau, or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edif. China Plaza, 17.º Andar, Macau;
    3. Fax to the GPDP (Fax: 28716116);
    4. Email to: < info@gpdp.gov.mo>.  Please note, your enquiry sent by email could be exposed on open network and run the risk of unauthorized access or abuse by third parties;
    5. File your enquiry via this website;
    6. Calling our Office (Tel.: 28715666).
  4. For fairness and to safeguard all concerned parties’ interests, you may speak directly to our reception staff, but arrangement depends on the actual details of the enquiry.  During the initial meeting, our staff may provide preliminary remarks for your case.  You may appoint another meeting, if necessary, in order to further proceed your enquiry. 
  5. If your enquiry involves concrete data processing, the GPDP may request a written enquiry or personal visit for filing an enquiry or its follow-ups.  You have to provide information to justify your identity as a data subject or data controller, or information to prove your involvement with the data processing. These are not mandatory but your refusal may affect your enquiry. 
  6. If the request involves application for opinion, the GPDP may ask you to file an official application.
top

Complaints
  1. The GPDP accepts and handles complaints relating to personal data processing free of charge, in accordance with the PDPA. If the complaint itself is against the GPDP, it shall be handled according to the general administrative procedures for public departments.
  2. Before filing any complaints, please first read our Personal Data Collection Statement.
  3. Complaints can be filed through:
    1. Personal visit (Address of the GPDP: Av. da Praia Grande, No. 804, Edif. China Plaza, 17.º Andar, Macau);
    2. Mail to P.O Box 880, Macau, or to the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edif. China Plaza, 17.º Andar, Macau;
    3. Fax to the GPDP (Fax: 28716116);
    4. Email to: < info@gpdp.gov.mo>.  Please note, complaint sent by email could be exposed on open network and run the risk of unauthorized access or abuse by third parties.
    5. File your complaint via this website.
    6. Calling our Office (Tel.: 28715666).
  4. Complaint forms are available here if you intend to file a written complaint.
  5. For fairness and to safeguard all concerned parties’ interests, you may speak directly to our reception staff, but arrangement depends on the actual details of the complaint.  We may collect preliminary information about your case for subsequent procedures in the meantime.
  6. For your complaint to proceed, you have to produce your valid ID for authentication, but this is not mandatory.  If the Complainant refuses to prove his identity, instead of filing a complaint he can inform the GPDP his case by making a report.  But this may affect how the GPDP follows up his case and the subsequent investigation.  In some cases, the GPDP may refuse to provide any reply.
  7. For processing the complaint and to safeguard the data subjects’ lawful interests, the GPDP may require the Complainant to file his complaint through personal visit and/or in writing, or he may be asked to provide information to substantiate his involvement as the data subject.  In addition, he may also be asked to vindicate his relationship with the respective data processing.  All these are not obligatory, but may affect the GPDP’s subsequent case procedures if the Complainant refused so.
  8. If the complainant refused the GPDP’s provision of his information to the complainee(s) or other authorities or entities, he should specify clearly in his complaint. But this may affect how the GPDP handles the complaint.
  9. According to Article 14 the PDPA, anyone suffered damages as caused by unlawful processing of personal data or other violation of laws and regulations of personal data protection can initiate civil proceedings of reparation against the entity responsible for the respective data processing.  The handling of the complaint by the GPDP will not affect the period prescribed for the related legal proceedings
top

The Personal Data Processing Register
              In accordance with Article 25 of the Personal Data Protection Act, the notifications and authorizations for personal data processing shall be registered on the GPDP’s database for public access.
             An online Register has been set up on the GPDP's website for checking the registered personal data processing. On the other hand, complete and submit the Application Form for Checking the Personal Data Processing Register (to download) to the GPDP personally (address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao) or send it by post (postal address: P.O Box 880, Macao; or the Office for Personal Data Protection, Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao). The GPDP will inform the register in writing.
top

Application for PDPA Seminar
  1. The Office for Personal Data Protection (hereafter as the GPDP) provides seminars on the Personal Data Protection Act (PDPA) to private and public institutions free of charge. 
  2. Seminars can be co-organized or jointly organized by the GPDP, and the applicant institution should be one of the organizers. In other words, the GPDP is a co-organizer or will jointly organize the seminar.
  3. After completing the Seminar Application Form (to download), make sure the information filled in is correct. A completed form should be stamped with the institution seal and signed by the person in charge, before submitting to the GPDP by:
    1. personally visiting the GPDP (Address: Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    2. post (Postal address: P.O Box 880, Macao; or the Office for Personal Data Protection, at Av. da Praia Grande, No. 804, Edf. China Plaza, 17.º Andar, Macao).
    3. fax (Fax number: 28716116).
  4. The PDPA seminar serves to highlight the basics of the Personal Data Protection Act. Therefore, it does not aim to explain or answer for specific cases. Likewise, no analyses or opinions are given for a specific case during the seminar. Should there be a need for enquiry or opinion on a specific case from the GPDP, an institution should submit an enquiry or an application separately.
  5. If the applicant institution has specific requirements for the seminar content or for the activity arrangement, it should specify clearly in the application form aforesaid.
  6. To facilitate the applications for seminars, the GPDP may require an institution to provide further information, including the nature, status of the participants, venue arrangement, and others. In addition, the GPDP will further discuss the activity arrangement with the applicant institution.
  7. Generally the GPDP will inform the institution of the final application result through an official letter.
top


Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116