Macau. Comprehensive data protection. Law
PDPA (Macau)Personal Data Protection Act (Law No. 8/2005) (Lei da Protecção de Dados Pessoais)
Partly verified
Medium confidence.Exact adoption/in-force days from general knowledge. [Link: official Portuguese/Chinese (Boletim Oficial I série 2005/34); GPDP/DSPDP English reference translation not verifiable (site unreachable)]
§1Summary
- Synopsis
Macau's data protection law, modelled on the Portuguese implementation of EU Directive 95/46. It sets lawfulness criteria, special-category rules, data subject rights and notification/authorisation filings with the GPDP.
- Key themes
- Unique features
Directive-era design with notification/authorisation filings to the regulator, including for GBA standard contracts.
- SaaS relevance
Applies to controllers established in Macau or using means in Macau; transfers out need adequacy, consent or GPDP authorisation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None under PDPA (CI operators report under 2019 Cybersecurity Law)
- DPO
- No
- Cross-border transfers
- Adequacy, consent or GPDP authorisation; GBA standard contract filing
- Maximum penalty
- Administrative fines and criminal sanctions incl. imprisonment
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text images.io.gov.mo
- Authority
- Office for Personal Data Protection (GPDP/OPDP)
§5Where it applies
- Domestic law of
- Macau
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Exact adoption/in-force days from general knowledge. [Link: official Portuguese/Chinese (Boletim Oficial I série 2005/34); GPDP/DSPDP English reference translation not verifiable (site unreachable)]