--- title: "Macau SAR, China Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/macau-sar-china/ source_html: /jurisdictions/macau-sar-china/index.html description: "Macau SAR, China data protection and privacy regulation: 10 categories, 30 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 6cdcc04f4ce599aff7fa110d3072bd53879befb38c76657aa26ce9667ec352c5 generator: "fe-fleet/md-twin@1.0" --- # Macau SAR, China Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 30 claims · 24 sources in the cumulative register Download report (PDF) Expand all Macau's data-protection regime shows a possible administrative reorganisation this cycle: a Personal Data Protection Bureau (PDPB) appears to be established under Administrative Regulation No. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Sectoral Watch, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Not fully checked this cycle: Regulator & Framework (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MACAU-SAR-CHINA)[Build Report](/reports/?j=MACAU-SAR-CHINA)[Compare](/compare/?j=MACAU-SAR-CHINA) Framework posture Monitored baseline 0 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Personal Data Protection Bureau (PDPB) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 0 / 10 modules assessed 0 Confirmed · 0 Probable · 0 Uncertain · 10 Not yet assessed 10 Categories 0 Red categories 3 Sub-modules 30 Claims 2 Tier-1 sources Traffic-light mix 10 n/a (sums to 10 rendered categories; click to filter) No categories are currently flagged red. ## Jurisdiction lead brief ###### Latest update · 25 October 2026 #### Lead Signal Macau's data-protection regulatory identity has been corrected as at 25 October 2026: the Personal Data Protection Bureau (PDPB) is confirmed as the current supervisory authority, established under Administrative Regulation No. 42/2023 and in force from 1 February 2024, superseding the former Office for Personal Data Protection that had operated as a temporary unit since 2007. This is a correction to the regulator's identity and legal form rather than a change in the underlying law, which remains the Personal Data Protection Act, Law No. 8/2005. #### Other Developments The PDPB's statutory basis and territorial reach are confirmed as standing features of the regime. The Personal Data Protection Act applies to data controllers and processors in Macau, and to those outside Macau that use equipment located in Macau, a territorial-scope rule that has not changed in this window. Data controllers, or their representatives, must notify the PDPB in writing within eight days of starting any wholly or partly automatic processing operation intended to serve a single purpose or related purposes, an obligation understood to arise under the Personal Data Protection Act though its pinpoint article has not been confirmed from primary text. The PDPB also holds a standing power under the surveillance-governance regime. Administrative Regulation No. 42/2023 empowers the PDPB to issue binding opinions in accordance with Law No. 2/2012, the legal regime governing video surveillance in public spaces, a power that continues unchanged alongside the Bureau's general data-protection remit. #### Cross-Monitor Connections No development in this window was found to warrant a referral to another monitor; the regulator-identity correction and the standing statutory-scope and surveillance-opinion powers described above are confined to the data-protection regime as administered by the PDPB. #### Outlook No legislative amendment or enforcement action dated within this window was confirmed. The principal gap remaining is confirmation of the pinpoint statutory article underlying the eight-day notification duty, which has not yet been verified against primary text. Future verification of that pinpoint citation, and any further enforcement activity reported by the PDPB, would be the next markers of movement in this jurisdiction's regulatory posture. 1 earlier update not shown here. ###### Standing brief · as of 28 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Macau's data-protection regime shows a possible administrative reorganisation this cycle: a Personal Data Protection Bureau (PDPB) appears to be established under Administrative Regulation No. 42/2023, though the relationship between this new bureau and the legacy Gabinete para a Protecção de Dados Pessoais (GPDP) naming remains unresolved. The GPDP is understood to be a genuinely separate supervisory authority from AMCM, the financial and crypto regulator, confirming that Macau's data-protection oversight sits institutionally apart from its financial-sector supervision. #### Other Developments Cross-border transfer flexibility is confirmed under Article 20 of the Personal Data Protection Act (PDPA), which permits transfers of personal data outside Macau without prior approval from the data-protection authority in certain circumstances, including explicit consent or contractual necessity. This is a derogation from what is otherwise a prior-authorisation default for cross-border transfers, and it gives controllers a materially faster compliance pathway for transfers falling within the listed exceptions. Breach-notification absence is a structural feature of the PDPA rather than a gap under active repair: the statute does not require specific action in the event of a data breach. Reports suggest the only adjacent notification channel runs through Macau's Cybersecurity Committee, of which the data-protection bureau is a member, and to which critical-infrastructure operators must separately report cybersecurity incidents. This creates a two-track system in which data breaches as such carry no PDPA-mandated notification duty, while a narrower category of cybersecurity incidents affecting critical infrastructure does. Enforcement intensity has declined : the data-protection authority's investigations resulted in penalties in 25% of cases in 2023, falling to 17% of cases in 2024. There is understood to be no collective-redress mechanism protecting the aggregate interests of data subjects in Macau, leaving individual civil claims, where a compensation right exists under the statute, as the only private redress avenue, albeit one with no confirmed case law located this cycle. #### Cross-Monitor Connections The possible GPDP-to-PDPB reorganisation and the AMCM/GPDP institutional separation are relevant to the crypto monitor's treatment of Macau, where AMCM's virtual-asset prohibition operates entirely outside the data-protection authority's remit; readers following Macau's virtual-asset regulatory posture through the crypto monitor should not conflate AMCM enforcement with data-protection enforcement, as the two run through structurally separate authorities. No direct connection to the financial-integrity or world-payments monitors was identified in this cycle's data-protection material. #### Outlook Whether the Personal Data Protection Bureau formally supersedes or merely operates alongside the GPDP name, and whether dspdp.gov.mo is now the authoritative regulator domain, remains open and would clarify the practical face of Macau's data-protection enforcement going forward. The declining penalty rate across 2023-2024 also warrants continued observation: it is not yet possible to distinguish an administrative capacity transition from a genuine reduction in enforcement intensity, and either reading carries different implications for compliance risk assessment in Macau. Read full brief · 836 words Key regulatory facts for Macau SAR, China Regulatory Dimension Macau SAR, China Standing Position Jurisdiction Macau SAR, China (MO) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 30 sourced findings) Primary Instruments Cited PDPB official homepage, Chambers Data Protection & Privacy 2026, Macau chapter, Macau SAR Personal Data Protection Bureau, Consentstack Macau PDPA guide, Global Legal Post Last Confirmed / Updated 2026-11-04 (24 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Macau SAR, China: D1 Regulator & Framework 10 claims Not assessed ▾ No standing position recorded for this category. Supervisory authority Personal Data Protection Bureau (PDPB) #### Sub-modules (1) #### Regulator And AuthorityNot assessed No narrative recorded for this sub-module. Claims (4): - Personal Data Protection Bureau (PDPB) establishes: Administrative Regulation No. 42/2023, Art. 1, establishes PDPB as the public department responsible for PDPA (Law No. 8/2005) obligations; entered into force 1 February 2024, restructuring the former OPDP into a permanent bureau under the Chief Executive's authority. - The GPDP is a genuinely separate supervisory authority from the AMCM (the financial/crypto regulator). - Personal Data Protection Bureau (PDPB) — Former Office for Personal Data Protection (OPDP/GPDP, est. 2007 as temporary unit) as the permanent regulator from 1 February 2024. - Personal Data Protection Bureau (PDPB) — Administrative Regulation No. 42/2023, Art. 1, establishes PDPB as the public department responsible for PDPA (Law No. 8/2005) obligations; entered into force 1 February 2024, restructuring the former OPDP into a permanent bureau under the Chief Executive's authority. #### Regulator & Framework Macau's data-protection framework continues to rest on the omnibus Personal Data Protection Act (Law 8/2005), with the data-protection authority historically known as the Gabinete para a Protecção de Dados Pessoais (GPDP). This cycle surfaces a possible administrative reorganisation: reports indicate a Personal Data Protection Bureau (PDPB) is set up in accordance with Administrative Regulation No. 42/2023, which governs the organisation and operation of the Personal Data Protection Bureau. The precise relationship between this newly reported PDPB and the legacy GPDP naming has not been resolved this cycle, and it is unclear whether dspdp.gov.mo, the domain associated with the PDPB reporting, is now the authoritative regulator domain in place of the historical GPDP identity. Separately, the GPDP is confirmed as a genuinely separate supervisory authority from AMCM, the Monetary Authority of Macao that regulates financial services and, by extension, virtual-asset activity. This institutional separation matters for any cross-sector compliance analysis: an AMCM enforcement action or policy position, such as its prohibition on virtual-asset financial services, carries no direct bearing on data-protection compliance, and vice versa. #### Outlook Resolution of the GPDP/PDPB naming and domain-authority question is the primary open item for this module. Confirmation of whether Administrative Regulation No. 42/2023 represents a formal supersession of the GPDP, a rebranding, or the establishment of a genuinely new body operating alongside existing structures would materially clarify the practical regulator relationship for compliance purposes in Macau going forward. Read full narrative · 236 words Periodic update · new data 2026-11-04 #### Regulator & Framework Macau's general legal regime for personal-data processing continues to rest on Act 8/2005, the Personal Data Protection Act, which entered into force on 1 February 2006, one hundred and eighty days after its signing and publication on 10 August 2005. The Act applies to any controller domiciled or based in Macau SAR, or to a controller using a computer or data-communication network access provider established in Macau, a territorial-scope test that has not changed as at this review. A question has surfaced over which body currently holds regulatory authority under this framework. Secondary commentary indicates that the Office for Personal Data Protection, commonly referenced as GPDP or OPDP, may have been reconstituted in 2023 into the Personal Data Protection Bureau under Administrative Regulation No 42/2023. This succession is not yet reconciled against the naming used elsewhere in current reporting, and no primary-source confirmation settles which designation is now authoritative. Separately, guidance attributed to the regulator has flagged that mainland China's Personal Information Protection Law applies extraterritorially to Macau-based controllers that process the data of individuals in mainland China, operating alongside the domestic Act 8/2005 regime and carrying stricter sanctions where it applies. The date of that guidance has not been established. #### Outlook Resolution of the regulator's current institutional name and legal successor would clarify whose guidance, enforcement actions and public statements should be treated as authoritative going forward. Until a primary-source text is located, both designations should be read as potentially referring to the same body at different points in time rather than as two distinct regulators. 3 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Macau's data-protection framework is anchored in the Personal Data Protection Act, Law No. 8/2005, which remains the operative statute as at 25 October 2026. The current supervisory authority is the Personal Data Protection Bureau (PDPB), established as a public department by Administrative Regulation No. 42/2023 and in force from 1 February 2024, with responsibility for carrying out the legal obligations set out under Law No. 8/2005. The PDPB supersedes the former Office for Personal Data Protection, which had operated as a temporary unit since 2007; this is a correction to the regulator's organisational history and current legal form rather than any change to the underlying statute. The Act's territorial scope extends to data controllers and processors located in Macau, and to those outside Macau that use equipment located in Macau, establishing an equipment-based test for extraterritorial reach. A data controller, or its representative, must notify the PDPB in writing within eight days after starting any wholly or partly automatic processing operation intended to serve a single purpose or related purposes; the specific statutory article underlying this notification duty has not yet been confirmed from primary legal text. Separately from its general data-protection remit, the PDPB is empowered under Administrative Regulation No. 42/2023 to issue binding opinions in accordance with Law No. 2/2012, the Legal Regime of Video Surveillance in Public Spaces, giving the Bureau a defined supervisory role over public-space video-surveillance matters that sits alongside its core registration and oversight functions under the Personal Data Protection Act. #### Outlook The principal open item is confirmation of the pinpoint statutory article for the eight-day notification duty, which has not been verified against primary text in this window. No legislative amendment to the Personal Data Protection Act or to Administrative Regulation No. 42/2023 was identified in this window. Future developments to watch include any further clarification of the PDPB's notification and registration procedures, and any formal guidance issued under its video-surveillance binding-opinion power. Periodic update · new data 2026-10-11 #### Regulator & Framework Macau's data-protection regulator is the Personal Data Protection Bureau (PDPB), established under Administrative Regulation No. 42/2023, which took effect on 1 February 2024. The PDPB succeeded the former Office for Personal Data Protection (OPDP), and this is a material naming correction from any prior-cycle reference to a 'GPDP' designation, which this cycle's evidence does not support. The PDPB's own website independently confirms its establishment, stating it was set up in accordance with Administrative Regulation No. 42/2023, Organization and Operation of Personal Data Protection Bureau, giving the succession fact a primary-source basis in addition to the secondary-source account that first surfaced it. The substantive legal framework the PDPB administers has not changed: the Personal Data Protection Act (Law No. 8/2005) remains Macau's primary data-protection legislation, and it is based on the former EU Data Protection Directive rather than the General Data Protection Regulation that superseded that Directive in the European Union. No amendment to this Act was found this cycle. The PDPB operates as the SAR's data-protection authority under this unchanged statutory framework, with the regulatory-identity correction being purely institutional in nature -- a change in which body holds the regulator's functions, not a change in what those functions are or in the statute that defines them. This correction matters for any standing jurisdiction record or ongoing compliance reference that currently names the former OPDP or a 'GPDP' entity as Macau's data-protection authority: such references should now be updated to the Personal Data Protection Bureau (PDPB), with Administrative Regulation No. 42/2023 cited as the governing instrument and 1 February 2024 as its effective date. #### Outlook No further change to Macau's regulator identity or core statutory framework is indicated by this cycle's evidence. The Personal Data Protection Act (Law No. 8/2005) remains the operative legislation, now administered under the corrected PDPB designation, and any future amendment to either the Act or the PDPB's constituting regulation would be the next material development to watch for. Periodic update · new data 2026-10-04 #### Regulator & Framework The Personal Data Protection Bureau (PDPB) is confirmed as the current regulator responsible for Macau's data-protection obligations under Law No. 8/2005 (the PDPA). This status is established by Administrative Regulation No. 42/2023, Article 1, which entered into force on 1 February 2024 and restructured the former Office for Personal Data Protection into a permanent bureau operating under the authority of the Chief Executive. This is a structural correction to the regulatory-framework record: material referencing the former OPDP or a GPDP designation reflects a pre-2024 state of affairs and should be read as superseded. The underlying statute, the PDPA (Law No. 8/2005), itself remains unchanged by this administrative restructuring; what has changed is the institutional body charged with administering it, not the substantive data-protection rules themselves. The practical effect of this confirmation is primarily one of accurate attribution rather than substantive regulatory change: any notification, registration, complaint, or enforcement action under the PDPA since 1 February 2024 runs through the PDPB as a permanent statutory bureau, rather than through the prior, less formally constituted office structure. No further change to the regulator's powers, structure, or statutory mandate was located this period beyond the confirmation of its current designation. #### Outlook No near-term change to the regulator's identity or structure is indicated. The marker to watch is whether the PDPB, now operating on a more clearly established permanent-bureau footing, issues further administrative regulations or guidance expanding its own practice beyond the identity-establishing Administrative Regulation No. 42/2023, particularly given its separately-noted recent addition of a Greater Bay Area cross-border standard-contract mechanism to its notification form. Sources and claims (10) - [PDPB official homepage](https://www.dspdp.gov.mo/en/) — Personal Data Protection Bureau (PDPB) establishes: Administrative Regulation No. 42/2023, Art. 1, establishes PDPB as the public department responsible for PDPA (Law No. 8/2005) obligations; entered into force 1 February 2024, restructuring the former OPDP into a permanent bureau under the Chief Executive's authority. - [Chambers Data Protection & Privacy 2026, Macau chapter](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china) — The GPDP is a genuinely separate supervisory authority from the AMCM (the financial/crypto regulator). - [Macau SAR Personal Data Protection Bureau](https://www.dspdp.gov.mo/file/Laws%20and%20Regulations/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96%99%E4%BF%9D%E8%AD%B7%E6%B3%95_EN.pdf) — A Personal Data Protection Bureau (PDPB) is set up in accordance with Administrative Regulation No. 42/2023, Organization and Operation of Personal Data Protection Bureau. - [Macau SAR Personal Data Protection Bureau](https://www.dspdp.gov.mo/file/Laws%20and%20Regulations/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96%99%E4%BF%9D%E8%AD%B7%E6%B3%95_EN.pdf) — Personal Data Protection Bureau (PDPB) — Administrative Regulation No. 42/2023, Art. 1, establishing PDPB as a public department responsible for carrying out the legal obligations under Law No. 8/2005; in force from 1 February 2024. - [Chambers Data Protection & Privacy 2026, Macau chapter](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china) — Personal Data Protection Bureau (PDPB) — Former Office for Personal Data Protection (OPDP/GPDP, est. 2007 as temporary unit) as the permanent regulator from 1 February 2024. - [Consentstack Macau PDPA guide](https://www.consentstack.io/regulations/mo-pdpa) — Personal Data Protection Act (Law No. 8/2005) — Data controllers/processors in Macau, and those outside Macau using equipment located in Macau. - [Global Legal Post](https://www.globallegalpost.com/news/macaus-proactive-data-protection-rights-for-luxury-brands-793984685) — Macau data controllers — PDPB in writing within eight days after starting any wholly or partly automatic processing operation intended to serve a single purpose or related purposes. - [Macau SAR Personal Data Protection Bureau](https://www.dspdp.gov.mo/file/Laws%20and%20Regulations/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96%99%E4%BF%9D%E8%AD%B7%E6%B3%95_EN.pdf) — Act 8/2005 is Macau's core data-protection statute, in force since 1 February 2006. - [Macau SAR Personal Data Protection Bureau](https://www.dspdp.gov.mo/file/Laws%20and%20Regulations/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96%99%E4%BF%9D%E8%AD%B7%E6%B3%95_EN.pdf) — Act 8/2005 applies to controllers domiciled, based, or using Macau-situated network infrastructure. - [Macau SAR Personal Data Protection Bureau](https://www.dspdp.gov.mo/file/Laws%20and%20Regulations/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96%99%E4%BF%9D%E8%AD%B7%E6%B3%95_EN.pdf) — Personal Data Protection Bureau (PDPB) — Administrative Regulation No. 42/2023, Art. 1, establishes PDPB as the public department responsible for PDPA (Law No. 8/2005) obligations; entered into force 1 February 2024, restructuring the former OPDP into a permanent bureau under the Chief Executive's authority. ### Macau SAR, China: D2 Lawful Processing & Special Data Not assessed ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. Sources and claims (1) - [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments) — Personal Data Protection Act, Art. 7 — Sensitive personal data includes philosophical/political beliefs, political association/trade-union membership, religion, privacy, racial/ethnic origin, and health/sex-life data including genetic data; processing prohibited as a general rule. ### Macau SAR, China: D3 Data Subject Rights Not assessed ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. Sources and claims (1) - [DataGuidance GDPR v PDPA Macau comparison](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpa_macau__1.pdf) — PDPA Articles 10 and 11 — Under Articles 10 and 11 of the PDPA, data subjects have the right to information and right of access. ### Macau SAR, China: D4 Controller/Processor Duties Not assessed ▾ No standing position recorded for this category. #### Controller/Processor Duties The Personal Data Protection Act does not require specific action in the event of a data breach, meaning there is no standalone PDPA breach-notification obligation running to the data-protection authority or affected data subjects. Reports suggest this is a structural feature of the statute itself rather than an unaddressed drafting gap awaiting amendment. The absence of a breach-notification duty is only partially offset by a separate channel: the Personal Data Protection Bureau is a member of Macau's Cybersecurity Committee, and critical-infrastructure operators are separately obliged to report cybersecurity incidents to that committee. This creates a narrower, sector-specific notification pathway that applies to critical-infrastructure operators experiencing cybersecurity incidents, which may or may not overlap with what would, in a jurisdiction with a general breach-notification law, be treated as a reportable personal-data breach. The practical effect for controllers and processors operating in Macau is a bifurcated duty landscape: general personal-data-breach events carry no statutory notification trigger under the PDPA, while cybersecurity incidents affecting critical infrastructure carry a distinct, narrower reporting duty to the Cybersecurity Committee. No primary statute text confirming the absence of a breach-notification provision was directly reviewed this cycle; the position rests on secondary legal-practitioner reporting. #### Outlook Whether Macau will introduce a dedicated breach-notification obligation, aligning it more closely with regional peers that have adopted such requirements, remains an open question with no reform signal identified this cycle. Direct review of PDPA primary text to confirm the breach-notification absence would strengthen confidence in this finding. Read full narrative · 247 words No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (1) - [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments) — PDPA breach-notification provisions — The PDPA does not require specific actions in the event of data breaches; the PDPB is a member of Macau's Cybersecurity Committee, to which critical-infrastructure operators must report cybersecurity incidents. ### Macau SAR, China: D5 Cross-Border & Adequacy 6 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Sccs And BcrsNot assessed No narrative recorded for this sub-module. Claims (3): - Personal Data Protection Bureau (PDPB) introduces: PDPB added a new schedule to its personal-data-processing notification form allowing controllers to register a standard contract for cross-border personal-data flows within the Guangdong-Hong Kong-Macau Greater Bay Area. - Guangdong-Hong Kong-Macao Greater Bay Area Standard Contract — The GBA SCC facilitation mechanism applies only between Guangdong province and Hong Kong; it does not support transfers from or to the Macau SAR. - Personal Data Protection Bureau (PDPB) — PDPB added a new schedule to its personal-data-processing notification form allowing controllers to register a standard contract for cross-border personal-data flows within the Guangdong-Hong Kong-Macau Greater Bay Area. #### Cross-Border & Adequacy Article 20 of the Personal Data Protection Act establishes the framework for cross-border transfers of personal data out of Macau. While the default position under the PDPA is understood to require prior authorisation from the data-protection authority for such transfers, Article 20 carves out circumstances in which transfer may proceed without that prior approval, including where the data subject has given explicit consent or where the transfer is necessary for the performance of a contract. This derogation gives controllers a materially faster compliance pathway in the specific circumstances it covers, avoiding the delay associated with seeking prior authorisation on a case-by-case basis. The practical effect is a two-tier cross-border transfer regime: transfers falling within the Article 20 exceptions may proceed on a self-assessed basis, while transfers outside those exceptions are understood to remain subject to the authority's prior-approval requirement. This structure is broadly consistent with other jurisdictions that pair a general prior-authorisation default with defined statutory derogations, though Macau's specific list of qualifying circumstances has not been fully catalogued in the material available this cycle. #### Outlook Further clarity on the full scope of Article 20's derogations, and on how the data-protection authority applies the prior-authorisation default in practice for transfers falling outside those derogations, would sharpen the compliance picture for controllers with cross-border data flows involving Macau. Read full narrative · 220 words No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (6) - [GPDP (Macau)](https://www.dspdp.gov.mo/en/abstract_detail_copy/article/l13auv3o.html) — Personal Data Protection Bureau (PDPB) introduces: PDPB added a new schedule to its personal-data-processing notification form allowing controllers to register a standard contract for cross-border personal-data flows within the Guangdong-Hong Kong-Macau Greater Bay Area. - [Global Legal Post](https://www.globallegalpost.com/news/macaus-proactive-data-protection-rights-for-luxury-brands-793984685) — PDPA Article 20 — Article 20 of the PDPA enables cross-border data transfers without prior GPDP approval in certain circumstances, such as explicit consent or contractual necessity. - [Hogan Lovells](https://www.hoganlovells.com/en/publications/china-finalizes-facilitation-measures-for-data-flows-within-gba) — Guangdong-Hong Kong-Macao Greater Bay Area Standard Contract — The GBA SCC facilitation mechanism applies only between Guangdong province and Hong Kong; it does not support transfers from or to the Macau SAR. - [Lexology](https://www.lexology.com/library/detail.aspx?g=603310d7-4f2e-40d1-99c9-276988b33a09) — Personal Data Protection Act, Art. 20 — Cross-border data transfers from Macau generally require PDPB authorisation, subject to exceptions under Art. 20 (e.g. explicit consent, contractual necessity). - [Chambers Data Protection & Privacy 2026, Macau chapter](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china) — Macau has no adequacy-list framework; outbound transfers require prior regulator authorisation on a case-by-case basis. - [DataGuidance GDPR v PDPA Macau comparison](https://www.dataguidance.com/sites/default/files/gdpr_v._pdpa_macau__1.pdf) — Personal Data Protection Bureau (PDPB) — PDPB added a new schedule to its personal-data-processing notification form allowing controllers to register a standard contract for cross-border personal-data flows within the Guangdong-Hong Kong-Macau Greater Bay Area. ### Macau SAR, China: D6 Sectoral Watch Not assessed ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. Sources and claims (2) - [Macau Business](https://www.macaubusiness.com/mainlands-new-personal-data-protection-law-also-applicable-in-the-sar/) — PDPB — Macau institutions dealing with mainland-China-related matters to closely monitor and strictly comply with mainland China's PIPL given its extraterritorial reach, in parallel with PDPA compliance. - [Consentstack Macau PDPA guide](https://www.consentstack.io/regulations/mo-pdpa) — GPDP's guidance flags PIPL's extraterritorial applicability to Macau-based controllers alongside the domestic PDPA. ### Macau SAR, China: D7 AdTech & Commercial Privacy 2 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Direct MarketingNot assessed No narrative recorded for this sub-module. Claims (2): - Advertising Law (Law No. 7/2026) establishes: Law No. 7/2026, passed 28 April 2026, published 11 May 2026, establishes a technology-neutral general advertising regime covering internet, app and social-media advertising; enters into force 1 January 2027, replacing Law No. 7/89/M. - GPDP fined a company MOP 560,000 on 26 January 2022 for unsolicited telemarketing in violation of the PDPA, with corrective measures including a temporary processing ban and data erasure. #### AdTech & Commercial Privacy Macau's Legislative Assembly passed a new general Advertising Law, Law No. 7/2026, on 28 April 2026, published 11 May 2026. The law establishes a technology-neutral advertising regime that explicitly covers internet, app and social-media advertising, and is enacted but not yet effective: it enters into force on 1 January 2027, at which point it replaces the former Law No. 7/89/M. This is a material forthcoming development for commercial-privacy practice in Macau, since it is the first general advertising statute to explicitly extend to digital and social-media advertising channels, areas the prior 1989 law did not contemplate. The law's relationship to existing PDPA direct-marketing practice is prospective rather than settled. Under the PDPA, data subjects currently hold the right to object, upon request and free of charge, to the processing of their personal data for direct-marketing purposes. How the new Advertising Law's provisions will interact with this existing consent-and-objection framework once the law takes effect on 1 January 2027 is not yet established in available material; no PDPB guidance addressing that interaction has been located this period. The practical question for advertisers and platforms is whether the new law will introduce additional consent or disclosure requirements for internet, app and social-media advertising layered atop the PDPA's existing direct-marketing-objection right, or whether it will operate as a parallel, largely independent advertising-conduct regime. #### Outlook The principal marker to watch is the law's entry into force on 1 January 2027, and specifically whether the PDPB or another Macau authority issues guidance clarifying how the new advertising regime interacts with existing PDPA direct-marketing-consent practice ahead of that date. Advertisers and platforms operating in Macau's digital and social-media advertising space should treat the period between now and 1 January 2027 as a transitional window in which the regulatory requirements applicable to digital advertising are shifting from the 1989 framework toward the new technology-neutral regime. Read full narrative · 312 words No periodic updates recorded in this cycle Sources and claims (2) - [Lexology](https://www.lexology.com/library/detail.aspx?g=603310d7-4f2e-40d1-99c9-276988b33a09) — Advertising Law (Law No. 7/2026) establishes: Law No. 7/2026, passed 28 April 2026, published 11 May 2026, establishes a technology-neutral general advertising regime covering internet, app and social-media advertising; enters into force 1 January 2027, replacing Law No. 7/89/M. - [DataGuidance](https://www.dataguidance.com/news/macau-gpdp-issues-summary-enforcement-actions-taken) — GPDP fined a company MOP 560,000 on 26 January 2022 for unsolicited telemarketing in violation of the PDPA, with corrective measures including a temporary processing ban and data erasure. ### Macau SAR, China: D8 Algorithmic, Biometric & Surveillance Governance Not assessed ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. Sources and claims (2) - [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments) — Macau AI privacy framework — Macau does not have specific privacy requirements for the use of personal data in the context of AI. - [Macau SAR Personal Data Protection Bureau](https://www.dspdp.gov.mo/file/Laws%20and%20Regulations/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96%99%E4%BF%9D%E8%AD%B7%E6%B3%95_EN.pdf) — PDPB — Issue binding opinions in accordance with Law No. 2/2012 (Legal Regime of Video Surveillance in Public Spaces), per Administrative Regulation No. 42/2023. ### Macau SAR, China: D9 Children & Vulnerable Groups ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. ### Macau SAR, China: D10 Enforcement & Redress Not assessed ▾ No standing position recorded for this category. #### Enforcement & Redress Macau's data-protection enforcement record shows a declining penalty rate across the two most recent reported years: investigations by the data-protection authority resulted in penalties in 25% of cases in 2023, falling to 17% of cases in 2024. This decline could reflect a genuine reduction in enforcement intensity, an administrative transition in capacity possibly connected to the reported GPDP-to-PDPB reorganisation, or simply normal year-to-year variation in case outcomes; the evidence available this cycle does not allow these explanations to be distinguished with confidence. On private redress, there is no collective-redress mechanism in Macau for the protection of data subjects' collective interests, meaning affected individuals cannot pursue a class-action-style claim for a data-protection violation affecting a group. An individual compensation right exists via Macau's civil courts, but no confirmed case law applying this right was located this cycle, leaving its practical availability and the standards courts would apply largely untested on the current record. Together, these findings describe an enforcement and redress landscape that is formally present (regulatory investigation powers, an individual compensation right) but thin in demonstrated practice: a declining institutional penalty rate and an absence of confirmed private litigation outcomes. #### Outlook Continued monitoring of the penalty-rate trend into 2025-2026 data, once available, would help distinguish a capacity transition from a genuine enforcement slowdown. Any emergence of confirmed case law testing the individual compensation right under Article 14 would also be a significant development for assessing the practical strength of Macau's private redress avenue. Read full narrative · 246 words Periodic update · new data 2026-11-04 #### Enforcement & Redress Act 8/2005 contains administrative fine provisions for breaches of Macau's data-protection regime, but the exact maximum penalty figure cannot currently be stated with confidence. Secondary commentary offers figures ranging from MOP 100,000 to MOP 2,400,000 depending on the class of violation, and no primary-source, article-level figure from the statute itself has been confirmed to reconcile this range. The dispute is reported as a gap in secondary sourcing rather than as a recent change to the statute's penalty structure, which has not been amended as far as current evidence shows. #### Outlook Until the primary statutory text is reconciled against secondary commentary, the maximum financial exposure under Act 8/2005 should be treated as a range rather than a fixed figure. Clarification would also bear on the broader institutional question of which body is currently empowered to impose these penalties, given the unresolved succession question affecting the regulator's identity. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (5) - [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments) — GPDP enforcement activity — GPDP investigations resulted in enforcement penalties in 25% of cases in 2023 and 17% of cases in 2024. - [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments) — Macau data-protection redress regime — There is no collective redress mechanism for protection of the collective interests of data subjects in Macau. - [PDPB official homepage](https://www.dspdp.gov.mo/en/) — PDPB — Citizen complaints of suspected illegal use of personal data or invasion of privacy, as one of its fundamental tasks. - [Lektou](https://lektou.com/macaus-evolving-data-protection-landscape/) — PDPB has shifted focus from education to increased enforcement, levying fines for non-compliance in recent years, per law-firm commentary. - [Chambers Data Protection & Privacy 2025, Macau](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2025/macau-sar-china/trends-and-developments) — PDPB — Administrative-nature provisions of the PDPA under the PDPA and Administrative Regulation 42/2023; criminal cases are reported to and handled by the Public Prosecutor's Office. ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties