Law on Cybersecurity and Personal Data Protection exempts the processing of personal data from the formalities of declaration, notably in the case of: 

• Processing of data used by a natural person exclusively in the course of his or her personal, domestic or family activities;
• Processing of data concerning a natural person, the publication of which is prescribed by a legal or regulatory provision;
• Processing of data whose sole purpose is the keeping of a register which is intended for exclusively private use; etc. 

Furthermore, it is also provided that certain matters or actions are subject to prior authorisation by the competent authority before being implemented, these include: 

• Processing of personal data relating to genetic and medical data and scientific research in these fields;
• Processing of personal data relating to offences, convictions and security measures pronounced by the competent courts;
• Processing of personal data relating to a national identification number or any other identifier of the same kind, in particular telephone numbers;
• Processing of personal data containing biometric data;
• Processing of personal data for reasons of public interest, in particular for historical, statistical or scientific purposes;
• The proposed transfer of personal data to a third country. 

Requests for processing shall be submitted by the controller or his/her legal representative. However, the authorisation does not exempt its holder (data controller) or his representative from their responsibility towards third parties.