Macau SAR, China Data Protection & Privacy Regulation

Regulator & Framework

Macau's data-protection framework is anchored in the Personal Data Protection Act, Law No. 8/2005, which remains the operative statute as at 25 October 2026. The current supervisory authority is the Personal Data Protection Bureau (PDPB), established as a public department by Administrative Regulation No. 42/2023 and in force from 1 February 2024, with responsibility for carrying out the legal obligations set out under Law No. 8/2005. The PDPB supersedes the former Office for Personal Data Protection, which had operated as a temporary unit since 2007; this is a correction to the regulator's organisational history and current legal form rather than any change to the underlying statute.

The Act's territorial scope extends to data controllers and processors located in Macau, and to those outside Macau that use equipment located in Macau, establishing an equipment-based test for extraterritorial reach. A data controller, or its representative, must notify the PDPB in writing within eight days after starting any wholly or partly automatic processing operation intended to serve a single purpose or related purposes; the specific statutory article underlying this notification duty has not yet been confirmed from primary legal text.

Separately from its general data-protection remit, the PDPB is empowered under Administrative Regulation No. 42/2023 to issue binding opinions in accordance with Law No. 2/2012, the Legal Regime of Video Surveillance in Public Spaces, giving the Bureau a defined supervisory role over public-space video-surveillance matters that sits alongside its core registration and oversight functions under the Personal Data Protection Act.

Outlook

The principal open item is confirmation of the pinpoint statutory article for the eight-day notification duty, which has not been verified against primary text in this window. No legislative amendment to the Personal Data Protection Act or to Administrative Regulation No. 42/2023 was identified in this window. Future developments to watch include any further clarification of the PDPB's notification and registration procedures, and any formal guidance issued under its video-surveillance binding-opinion power.

Regulator & Framework

Macau's data-protection regulator is the Personal Data Protection Bureau (PDPB), established under Administrative Regulation No. 42/2023, which took effect on 1 February 2024. The PDPB succeeded the former Office for Personal Data Protection (OPDP), and this is a material naming correction from any prior-cycle reference to a 'GPDP' designation, which this cycle's evidence does not support. The PDPB's own website independently confirms its establishment, stating it was set up in accordance with Administrative Regulation No. 42/2023, Organization and Operation of Personal Data Protection Bureau, giving the succession fact a primary-source basis in addition to the secondary-source account that first surfaced it.

The substantive legal framework the PDPB administers has not changed: the Personal Data Protection Act (Law No. 8/2005) remains Macau's primary data-protection legislation, and it is based on the former EU Data Protection Directive rather than the General Data Protection Regulation that superseded that Directive in the European Union. No amendment to this Act was found this cycle. The PDPB operates as the SAR's data-protection authority under this unchanged statutory framework, with the regulatory-identity correction being purely institutional in nature -- a change in which body holds the regulator's functions, not a change in what those functions are or in the statute that defines them.

This correction matters for any standing jurisdiction record or ongoing compliance reference that currently names the former OPDP or a 'GPDP' entity as Macau's data-protection authority: such references should now be updated to the Personal Data Protection Bureau (PDPB), with Administrative Regulation No. 42/2023 cited as the governing instrument and 1 February 2024 as its effective date.

Outlook

No further change to Macau's regulator identity or core statutory framework is indicated by this cycle's evidence. The Personal Data Protection Act (Law No. 8/2005) remains the operative legislation, now administered under the corrected PDPB designation, and any future amendment to either the Act or the PDPB's constituting regulation would be the next material development to watch for.

Regulator & Framework

The Personal Data Protection Bureau (PDPB) is confirmed as the current regulator responsible for Macau's data-protection obligations under Law No. 8/2005 (the PDPA). This status is established by Administrative Regulation No. 42/2023, Article 1, which entered into force on 1 February 2024 and restructured the former Office for Personal Data Protection into a permanent bureau operating under the authority of the Chief Executive. This is a structural correction to the regulatory-framework record: material referencing the former OPDP or a GPDP designation reflects a pre-2024 state of affairs and should be read as superseded. The underlying statute, the PDPA (Law No. 8/2005), itself remains unchanged by this administrative restructuring; what has changed is the institutional body charged with administering it, not the substantive data-protection rules themselves.

The practical effect of this confirmation is primarily one of accurate attribution rather than substantive regulatory change: any notification, registration, complaint, or enforcement action under the PDPA since 1 February 2024 runs through the PDPB as a permanent statutory bureau, rather than through the prior, less formally constituted office structure. No further change to the regulator's powers, structure, or statutory mandate was located this period beyond the confirmation of its current designation.

Outlook

No near-term change to the regulator's identity or structure is indicated. The marker to watch is whether the PDPB, now operating on a more clearly established permanent-bureau footing, issues further administrative regulations or guidance expanding its own practice beyond the identity-establishing Administrative Regulation No. 42/2023, particularly given its separately-noted recent addition of a Greater Bay Area cross-border standard-contract mechanism to its notification form.