Privacy Map

Asia. National jurisdiction.

Macau MO

Primary authority: Office for Personal Data Protection (GPDP/OPDP)
Part I

Domestic law

Comprehensive data protection1

  • PDPA (Macau)Personal Data Protection Act (Law No. 8/2005) (Lei da Protecção de Dados Pessoais)In force
    In force from     Macau's data protection law, modelled on the Portuguese implementation of EU Directive 95/46. It sets lawfulness criteria, special-category rules, data subject rights and notification/authorisation filings with the GPDP.
    Synopsis

    Macau's data protection law, modelled on the Portuguese implementation of EU Directive 95/46. It sets lawfulness criteria, special-category rules, data subject rights and notification/authorisation filings with the GPDP.

    Key themes
    • legitimacy criteria
    • sensitive data
    • notification and prior authorisation
    • data subject rights
    • transfers
    Unique features

    Directive-era design with notification/authorisation filings to the regulator, including for GBA standard contracts.

    SaaS relevance

    Applies to controllers established in Macau or using means in Macau; transfers out need adequacy, consent or GPDP authorisation.

    Extraterritorial
    Limited
    Breach notification
    None under PDPA (CI operators report under 2019 Cybersecurity Law)
    DPO
    No
    Cross-border transfers
    Adequacy, consent or GPDP authorisation; GBA standard contract filing
    Maximum penalty
    Administrative fines and criminal sanctions incl. imprisonment
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Office for Personal Data Protection (GPDP/OPDP)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact adoption/in-force days from general knowledge. [Link: official Portuguese/Chinese (Boletim Oficial I série 2005/34); GPDP/DSPDP English reference translation not verifiable (site unreachable)]

    Full record for PDPA (Macau)
    Partly verifiedMedium confidence. Exact adoption/in-force days from general knowledge. [Link: official Portuguese/Chinese (Boletim Oficial I série 2005/34); GPDP/DSPDP English reference translation not verifiable (site unreachable)]

Cybersecurity1

  • Macau Cybersecurity LawCybersecurity Law (Law No. 13/2019)In force
    In force from     Sets security and incident-reporting duties for operators of critical infrastructure in Macau. Incidents must be notified to CARIC and the sector regulator.
    Synopsis

    Sets security and incident-reporting duties for operators of critical infrastructure in Macau. Incidents must be notified to CARIC and the sector regulator.

    Key themes
    • critical infrastructure
    • incident notification
    • security management
    Unique features

    Breach-reporting duty exists only for CI operators, filling a gap in the PDPA.

    SaaS relevance

    Relevant to SaaS vendors whose customers are Macau CI operators.

    Breach notification
    CI operators notify CARIC and regulator
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Cybersecurity Incident Alert and Response Center (CARIC) / Cybersecurity Committee
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. Law number and commencement date from general knowledge; source only confirms a 2019 Cybersecurity Law with CI incident reporting. [Link: official Portuguese/Chinese (Boletim Oficial 2019/25); no official English found; authority = Judiciary Police (runs CARIC)]

    Full record for Macau Cybersecurity Law
    Partly verifiedLow confidence. Law number and commencement date from general knowledge; source only confirms a 2019 Cybersecurity Law with CI incident reporting. [Link: official Portuguese/Chinese (Boletim Oficial 2019/25); no official English found; authority = Judiciary Police (runs CARIC)]