Monaco

Art. 5 requires one of six lawful bases for processing, art. 6 sets consent conditions, art. 11 lists the information to be given at collection, and arts. 12-19 give rights of access, rectification, erasure, restriction, objection, portability and protection against solely automated decisions. Requests are answered generally within one month, extendable by two months (art. 10).

Arts. 7-8 set notice of one month after more than six months of service, two months after more than two years, and three months for managers with more than two years, halved when the employee resigns. Art. 9 requires notice by registered letter or signed receipt.

Art. 32 requires the controller to notify the APDP as soon as possible and, if possible, within 72 hours of becoming aware of a breach; a later notice must explain the delay. Processors notify the controller as soon as they become aware, and affected individuals are informed where the breach is likely to pose a high risk.

Art. 4 lists when due diligence applies, including business relationships and suspicion of money laundering or terrorist financing. Art. 4-1 requires identifying and verifying the client, agent and beneficial owner, art. 4-3 requires information on the purpose of the relationship and the client's background, and art. 5 requires constant vigilance. Under art. 7 an entity that cannot complete due diligence may not establish or maintain the relationship.

Art. 4 requires prior authorisation from the Minister of State to create an insurance company, which must be a société anonyme or société en commandite par actions. Art. 6 requires approval before operations start, and art. 9 allows withdrawal if the financial position gives insufficient guarantees.

Art. 4 bars delegation of all of a firm's activities and keeps the delegating company responsible for delegated activities. Art. 5 requires the delegation to specify its type, scope, duration, the delegate's resources, remuneration, controls and revocation conditions. The approval file must list delegations (art. 3) and the annual report must flag changes (art. 22).