Macau PDPA

Macau Personal Data Protection Act (Law 8/2005) - consent, notification, GPDP oversight.


Short name	MO PDPA
Region	Asia-Pacific
Country or scope	Macau
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MO PDPA

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MO PDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for MO PDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MO-PDPA-SEC` Security of Processing	Controllers must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, alteration and unauthorised access, which includes verifiable integrity of processing software (Law 8/2005 security-of-processing obligation, Art. 15-style)	Scan
`MO-PDPA-SPSEC` Special Security Measures	Processing of sensitive categories requires reinforced security measures, implying maintained, up-to-date knowledge of the exact software versions handling such data (Law 8/2005 special security measures provision)	Scan
`MO-PDPA-NOTIF` Notification to GPDP	Automated processing operations must be notified to the GPDP with a description of the processing and the systems used, requiring identifiable, timestamped documentation of the processing platform (Law 8/2005 notification obligation)	Scan
`MO-PDPA-QUAL` Data Quality Principle	Personal data must be adequate, accurate and kept up to date; a processing environment can only demonstrate this discipline if its own software inventory is complete and versioned (Law 8/2005 data quality principles, Art. 5-style)	Scan
`MO-PDPA-PROC` Processing on Behalf of the Controller	Controllers must choose processors providing sufficient guarantees regarding security measures, which extends to knowing who supplies the software components used in processing (Law 8/2005 processor obligations)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MAC-5`	Data Processing Principles
`MAC-6`	Lawful Basis for Processing
`MAC-8`	Sensitive Data Processing
`MAC-10-11`	Data Subject Rights
`MAC-15`	Security of Processing
`MAC-19-20`	Cross-Border Transfer Controls
`MAC-22`	Notification to GPDP
`MAC-DPO`	Data Protection Officer & Governance

Policy templates

Written for MO PDPA:

Macau PDPA Privacy Notice

And 22 from the standard set, adapted to MO PDPA.