Macao

Art. 6 of Law 8/2005 requires unequivocal consent or another listed ground for processing; Art. 10 requires the controller to tell data subjects its identity, the purposes, the recipients and their access and rectification rights; Art. 11 gives rights of access, rectification, erasure and blocking; Art. 12 gives a right to object, free of charge for direct marketing.

Art. 21(1) of Law 8/2005 requires the controller to notify the public authority in writing before processing starts, with simplified or waived notification for certain low-risk categories (Art. 21(2), (4)). Art. 22(1) requires prior authorisation for sensitive data, credit and solvency data, data interconnection and processing for a new purpose. This is not a data breach notification: the law contains no breach notification duty. Art. 21(1) sets the 8-day period from the start of processing.

Art. 6 of Administrative Regulation 7/2006: proof of compliance with the due diligence duties is kept for at least 5 years after the transaction (n.º 1), and identification records, account files and business correspondence for at least 5 years after the account is closed or the business relationship ends (n.º 2). Law 2/2006, Art. 7(1)(4), itself says only 'a reasonable period'.

Art. 3 of Administrative Regulation 7/2006 requires covered entities to obtain and verify the identity of contracting parties, clients or patrons from credible, independent sources when a relationship is established, when operations suggest a crime, for occasional transactions above thresholds set under supervisors' instructions, and when identity data is doubtful. It also requires them to identify beneficial owners, including by understanding the ownership structure of legal persons, to assess risk, apply enhanced diligence to high-risk parties and monitor transactions continuously; anonymous accounts are prohibited. Art. 5 requires refusal of the operation if the information cannot be obtained. Law 2/2006, Art. 7(1) sets the underlying duty.

Art. 11 of Law 13/2019 requires private operators to inform CARIC of incidents and notify their supervisory entity, and to start response actions at once for serious incidents. Art. 12(2) requires an annual cybersecurity report to the supervisor listing recorded incidents. The duty also covers insurance, healthcare, telecommunications and casino gaming operators (Arts. 4-5).

Para. 9(d) and para. 10 of the Guideline on Outsourcing require institutions to consult the AMCM in advance before entering agreements to outsource material activities, after board approval, and to show that the prudential issues in paras. 15-34 are addressed. Para. 13 requires notification of the AMCM within 30 days of executing the agreement; para. 24 requires reporting significant problems and para. 25 notice of termination as soon as practicable. No fixed lead time is given for the prior consultation.

Art. 7 of Administrative Regulation 7/2006 requires suspicious transactions to be reported to the entity designated under Art. 8(2) of Law 2/2006, regardless of the amount involved and even if the operation was not carried out. AMCM Notice 015/2014 (para. 124) and the AMCM's statement of 5 May 2017 name the Financial Intelligence Office as the recipient. Law 2/2006, Art. 7(1)(5) covers operations that may indicate money laundering.

Section III of the guidelines annexed to Notice 015/2014-AMCM says each institution should appoint management-level Compliance Officer(s) (para. 126) with sufficient status and resources (para. 132), designate an officer for money laundering deterrence and reporting (para. 119), and keep an independent, adequately resourced audit function that tests compliance periodically (para. 134). Para. 29 requires institutions to assess and document their ML/TF risks.