Service introduction
According to the Personal Data Protection Act, if a data controller intends to process personal data wholly or partly by automatic means; and under certain circumstance that it processes personal data with non-automatic means, forming part of a manual filing system or which are intended to form part of a manual filing system, it is required to file a notification to the Personal Data Protection Bureau, in order to discharge its notification obligation according to laws.
Aside from circumstances where simplified notification or exemption from notification are fulfilled, normally a data controller shall notify the Personal Data Protection Bureau for these four types of personal data processing:
- Processing of personal data by automatic means: e.g. merchants documenting customer data through computer, or merchants installing surveillance camera system in shop interior and exterior.
- Processing sensitive data but data subjects are unable to provide their consent: e.g. social service institutions provide healthcare services to elderlies and process their sensitive data, including health data, and they are unable to provide explicit consent, such processing has to be legally notified to the Personal Data Protection Bureau, despite the data may be processed by non-automatic means.
- Notification obligation when providing information to the data subjects may be waived: e.g. the processing is for statistical purposes or for the purposes of historical or scientific research and will involve huge amount of personal data to be processed (for instance, educational institutions conduct researches and have to process troves of personal data), and where the provision of information proves impossible or would involve a disproportionate effort, under such circumstances notification to the Personal Data Protection Bureau is required before the personal data processing takes place.
- Transfer of personal data to a location outside the Macao SAR: e.g. the network server of an institution is located in a place outside the Macao SAR, or the institution uses software located on a server outside of Macao SAR to process personal data.
Based on the principle of speed, economy and efficiency and under Article 21(2) of the Personal Data Protection Act, three simplified notifications for personal data processing have been issued by the PDPB:
- The Processing of Personal Data by Video Surveillance System for Security Purpose (Authorization No. 01/2013)
- Personal Data Processing by Vehicle Positioning Systems and Devices (Authorization No. 01/2014)
- First Time Collecting and Processing of the Data of Individuals Entering and Exiting Venues for the Prevention and Control of Infectious Diseases (Data transfer to a location outside the Macao SAR) (Authorization No. 01/2020)
In order to fulfill the notification obligation as required by laws you may submit your notification as simplified notification if your case falls within the processing purposes, types of personal data, and meets other conditions that specified in the aforesaid three documents.
Service targets
Under the Personal Data Protection Act, the data controller, or its representative, who is required to submit the initial notification to the Personal Data Protection Bureau; or the data controller, or its representative, who applies to renew or annul the notification registration.
Result of service
The result will be communicated in writing, and the notification will be registered and made accessible to the public according to laws.
Means of enquiry
Responsible Department：Personal Data Protection Bureau
Address：Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau
Mailing Address：Macao P.O. Box 880
Tel：（853）2871 6006
Fax：（853）2871 6116
Email：info@dspdp.gov.mo
Website：www.dspdp.gov.mo