DATA PROTECTION LAWS OF THE WORLD REGISTRATION REGISTRATION In general terms, depending on the type of personal data and on the purposes of the processing either: The OPDP must be notified of any processing of personal data by a data processor unless an exemption applies. prior notification to APD, or prior authorisation from the APD, is required. Please note that in the case of authorisation, compliance with specific legal conditions are mandatory. The APD may exempt certain processing from the notification requirement. In general terms, notification and authorisation requests should include the following information: the name and address of the controller and of its representative (if applicable) the purposes of the processing a description of the data subject categories and the personal data related to those categories the recipients or under which categories of recipient to whom the personal data may be communicated and respective conditions details of any third party entities responsible for the processing the possible combinations of personal data the duration of personal data retention the process and the conditions for a data subject to execute further rights of access, rectification, deletion, opposition and updating any predicted transfers of personal data to third countries For certain data categories (eg, certain sensitive personal data, data regarding illicit activities or criminal and administrative offenses or credit and solvency data) and certain specific personal data processing, data processors must obtain prior authorization from the OPDP. The OPDP provides (official) forms that must be submitted regarding personal data processing, either in Portuguese or Chinese language, along with the following information (if applicable): Identification and contact details of the data processor and its representatives The personal data processing purpose Identification and contact details of any third party carrying out the personal data processing The commencement date of the personal data processing The categories of personal data processed (disclosing whether sensitive personal data, data concerning the suspicion of illicit activities, criminal and / or administrative offenses or data regarding credit and solvency are to be collected) The legal basis for processing personal data The means and forms available to the data subject for updating his or her personal data Any transfer of personal data outside Macau, along with the grounds for, and measures to be adopted with, the transfer Personal data storage time limits Interconnection of personal data with third parties Security measures adopted to protect the personal data a general description (which will allow the APD to assess the suitability of the measures adopted to ensure the processing security). DATA PROTECTION OFFICERS DATA PROTECTION OFFICERS There is no obligation to appoint data protection officers. There is no legal requirement to appoint a data protection officer in Macau. COLLECTION & PROCESSING COLLECTION & PROCESSING In general terms, personal data collection and processing Personal data may be processed only if the data subject 3 | Data Protection Laws of the World | Angola vs Macau | www.dlapiperdataprotection.com