Personal data may be processed only if the data subject has given his or her unequivocal consent or if processing is deemed necessary:

• Execution of an agreement where the data subject is a party, or, at the data subject’s request, negotiation in relation to such an agreement;
• Compliance with a legal obligation to which the data controller is subject;
• Protection of vital interests of the data subject if he or she is physically or legally unable to give his or her consent;
• Performance of a public interest assignment or exercise of public authority powers vested in the data controller or in a third party to whom the personal data is disclosed; or
• Pursuing a data controller's legitimate interest (or the legitimate interest of a third party to whom the data is disclosed), provided that the data subject’s interests or rights, liberties and guarantees do not prevail.

The data subject must be provided with all relevant processing information, including the identification of the data controller, the purpose of processing, and the means and forms available to the data subject for accessing, amending and deleting his or her personal data. Moreover, if applicable, the data subject should also be informed of the possibility of their data being transferred to a jurisdiction outside of Macau.