The basics
Lawful basis for processing, purpose limitation, data subject rights, security obligations, and restrictions on cross-border transfer. The supervisory body is the Personal Data Protection Bureau (PDPB).
What this means for you
Macau has no separate AI-specific regime, and the PDPB publishes AI and privacy material expressly marked non-binding. If you operate in both territories, the practical answer is one privacy system covering both, not two.
Cross-border transfer
Transferring personal data out of Macau requires an adequate level of protection or a lawful derogation. In practice this is handled contractually.
Where a Hong Kong firm serves Macau customers but keeps the data in Hong Kong, the transfer obligation still applies — and it is the item most often missed until a customer or the PDPB asks.