The framework
Macau's framework rests on the Personal Data Protection Act (Law 8/2005), with the Office for Personal Data Protection as the supervisory authority.
That puts Macau in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Personal Data Protection Act (Law 8/2005)
Macau transplanted the pre-GDPR EU directive into local law in 2005 and enforces it through the GPDP, with notification duties that surprise operators used to the GDPR's accountability model. The casino economy keeps CCTV, marketing and cross-border questions on the regulator's desk.
Marketing and advertising
EU-directive-modeled: consent or another legitimacy ground; notification duties to the GPDP for many processing operations. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad need an adequacy-style assessment of the destination or GPDP authorization.
Enforcement and penalties
Administrative fines and criminal penalties for serious violations.