Macau PDPA
Macau Personal Data Protection Act (Law 8/2005) - consent, notification, GPDP oversight.
Macau Personal Data Protection Act (Law 8/2005) - consent, notification, GPDP oversight.
| Short name | MO PDPA |
| Region | Asia-Pacific |
| Country or scope | Macau |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers MO PDPA
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MO PDPA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 23: 1 written for MO PDPA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
MO-PDPA-SEC Security of Processing | Controllers must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, alteration and unauthorised access, which includes verifiable integrity of processing software (Law 8/2005 security-of-processing obligation, Art. 15-style) | Scan |
MO-PDPA-SPSEC Special Security Measures | Processing of sensitive categories requires reinforced security measures, implying maintained, up-to-date knowledge of the exact software versions handling such data (Law 8/2005 special security measures provision) | Scan |
MO-PDPA-NOTIF Notification to GPDP | Automated processing operations must be notified to the GPDP with a description of the processing and the systems used, requiring identifiable, timestamped documentation of the processing platform (Law 8/2005 notification obligation) | Scan |
MO-PDPA-QUAL Data Quality Principle | Personal data must be adequate, accurate and kept up to date; a processing environment can only demonstrate this discipline if its own software inventory is complete and versioned (Law 8/2005 data quality principles, Art. 5-style) | Scan |
MO-PDPA-PROC Processing on Behalf of the Controller | Controllers must choose processors providing sufficient guarantees regarding security measures, which extends to knowing who supplies the software components used in processing (Law 8/2005 processor obligations) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
MAC-5 | Data Processing Principles |
MAC-6 | Lawful Basis for Processing |
MAC-8 | Sensitive Data Processing |
MAC-10-11 | Data Subject Rights |
MAC-15 | Security of Processing |
MAC-19-20 | Cross-Border Transfer Controls |
MAC-22 | Notification to GPDP |
MAC-DPO | Data Protection Officer & Governance |
Policy templates
Written for MO PDPA:
- Macau PDPA Privacy Notice
And 22 from the standard set, adapted to MO PDPA.
Laos Law on Electronic Data Protection 2017
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Malaysia PDPA
Malaysia Personal Data Protection Act - data subject rights, processor obligations, consent, transfers.