NIST Privacy Framework, Govern-PGV.PO-P5

If enacted as drafted, a data controller and processor would each have to appoint a personal data protection officer and notify the Ministry of Post and Telecommunications of that appointment within 30 working days, maintain records of processing activities, and, if located outside Cambodia, appoint a local representative.

Obtain the data protection authority's prior authorization before processing personal data of a person established, resident, or in transit in Cameroon.

Get the agency's prior authorization before interconnecting personal data files held for different purposes or by different controllers, stating in the request the nature of the data, the interconnection's purpose, and its duration.

Prepare to register and report to the new Agencia de Protección de Datos Personales once the law commences; the current regulator structure under Ley 19.628 does not yet include a dedicated data-protection authority.

Register your databases with the Superintendencia de Industria y Comercio's National Registry of Databases and submit data treatment policies that never fall below this law's duties.

Declare personal data processing to the Commission before implementing it, or enter it in a register kept by a designated person, unless it is exempt as general accounting, payroll, supplier management, or a non profit association's membership processing.

Obtain the Commission's prior authorization before processing a national identification number or a national census, processing concerning state security, defense or public safety or the investigation and prosecution of offenses, interconnecting files serving different purposes, or processing that could exclude a person from a right, a benefit or a contract.

Register any database administered for distribution, dissemination, or commercialization purposes with the Prodhab.

Declare the processing to ARTCI in advance, or designate an internal correspondent for the protection of personal data in its place, except before a cross-border transfer.

Obtain ARTCI's prior authorization before processing on a national identification number or a personal-data set of public-interest, historical or scientific research value.

File a prior declaration with the Data Protection Authority before processing personal data, or obtain its prior authorization before processing genetic, medical, biometric, offense or conviction, national-identification, or cross-border-transfer data.

File a prior declaration with, or obtain the prior authorization of, the Commission Nationale de Protection des Données à Caractère Personnel before processing personal data, depending on the processing's risk category.

Register as a Sociedad de Información Crediticia with the Superintendencia de Bancos, after securing the Junta Monetaria's authorization, before operating as a credit reporting bureau.

Register with the national register of personal data protection as article 51 requires.

Notify the Eswatini Communications Commission of your processing of personal information before you process it, and again whenever the particulars you notified change.

Register with the Ethiopian Communications Authority before processing personal data, and appoint a data protection officer where the Proclamation requires one.

Obtain the Authority's prior authorization where you cannot provide appropriate safeguards for a transfer to a third-party jurisdiction, and consult the Authority before processing where an impact assessment indicates the operations are likely to present a high risk.

Declare an automated personal-data processing activity to the APDPVP before carrying it out and wait for the Authority's receipt before starting, unless a simplified or exempt category applies; processing touching a more sensitive category instead needs the APDPVP's prior authorization or a ministerial or Council-of-Ministers decree.

Before deploying an artificial-intelligence system, a facial-recognition or other biometric-identification system, a drone or other connected object, an electronic-signature or digital-identity service, or a national or sectoral identifier system that processes personal data, file the declaration or notice the applicable norme or decree requires with the APDPVP.

Have a lawful basis for processing personal data, and register with the Data Protection Commission before processing begins.

When registering as a data controller, disclose the countries to which personal data may be transferred.

An app that operates a database of the personal data of individuals in Israel above the small-collection thresholds must register with, or separately notify, the Privacy Protection Authority under Art. 8A, and must name a Data Protection Officer where the Act requires one.

Register with the Office of the Information Commissioner before processing personal data, and keep your registration particulars in the register the Commissioner maintains.

Appoint a representative established in Jamaica if you are not established there but process the personal data of data subjects in Jamaica to offer them goods or services or to monitor their behaviour.

Register with the Office of the Data Protection Commissioner if your volume or category of processing meets the prescribed threshold.

Appoint a registered representative in Kosovo if you are a controller or processor not established there but use automatic or other equipment in Kosovo to process personal data, unless that equipment is used only for transit through Kosovo.

Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than two hundred and fifty people and none of the high-risk, non-occasional or special-category exceptions apply, and cooperate with the Agency for Information and Privacy on request.

File a permit with the Ministry of Economy and Trade, issued against a receipt, before collecting or processing the personal data of a person in Lebanon, unless one of the exemptions in Article 94 covers the processing.

State in that permit the objectives of the processing, the personal data and its source, the categories of persons concerned, the third parties who may view the data, the retention period, your identity and address and those of your representative if you live outside Lebanon, the agency carrying out the processing, who exercises the right of access and how, any subcontractor, and the measures you take to keep the data intact.

Notify the Data Protection Commission of your processing of personal information before you process it, and again whenever the particulars you notified change.

Handle personal information collected, processed, transmitted, stored, or used in Liberia in line with Liberia's Data Protection Act, whose specific consent, notice, and data-subject-rights provisions are not described here.

Declare a processing operation to the CMIL before implementing it, or obtain its prior authorization first where the processing presents a particular risk to rights and freedoms or to privacy.

Comply with the Data Protection Act, 2024's rules for collecting, processing, storing, and sharing personal data, whether the personal data belongs to a private individual or is held by a public organisation.

Declare to the Autorité de Protection des Données à Caractère Personnel, before carrying it out, any processing operation you intend to carry out for a given purpose.

Complete the Personal Data Protection Authority's prior formalities before processing personal data; failing to do so, even negligently, is a criminal offence.

Declare your processing to the Authority before you start it, unless article 32 exempts it.

Carry out a data protection impact assessment before processing likely to result in a high risk, and consult the National Centre for Personal Data Protection beforehand where that risk remains.

Carry out a data protection impact assessment before processing likely to create a high risk to a person's rights and freedoms, such as large scale profiling with legal effects, large scale sensitive data processing, large scale public area surveillance, or large scale use of a digital identifier, and consult the Authority first where the assessment still shows a high risk you cannot mitigate.

Get the Minister of State's prior authorisation before installing a video surveillance system in a place open to the public or filming a public way, and do not keep recorded images for more than 30 days.

Keep records of every personal data filing system you establish, covering the matters Article 26 lists, and obtain the Agency for Personal Data Protection and Free Access to Information's prior consent before establishing or materially altering one, under Articles 27 and 28.

File a prior declaration with the CNDP before implementing an automated processing operation, or a set of related automated operations, unless the processing instead requires the CNDP's prior authorization.

If you are established outside Morocco but use processing means located there, notify the CNDP of the identity of a Morocco based representative who takes on your rights and obligations under the law.

If the Chief Regulator directs you to under section 49(4), monitor communications to a subscriber's connections to trace a harassing, offensive, or illegal call, to the extent your current technology allows.

Register with the data file register the Direccion de Proteccion de Datos Personales keeps before operating a data file, and wait for its registration decision within thirty days.

Collect, record, process, store and transmit personal data lawfully, fairly and without fraud.

Complete a prior declaration, authorisation request or advisory request with the HAPDP before implementing a processing operation, and obtain its prior authorisation for genetic, medical, biometric, interconnected, unique-identifier or sensitive-category processing.

Register with the Commission as a data controller or data processor of major importance where the Commission so determines, conduct a compliance audit within fifteen months of commencing business and annually thereafter, and file Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories.

Tell the Commission of any significant change to the information in your most recent registration submission within sixty days of the change.

Get the Agency's prior approval before any systematic and extensive processing of a citizen's national identification number, and otherwise process it only with the data subject's prior consent or another case a law states.

Carry out an impact assessment before implementing processing that warrants one, and consult the supervisory authority beforehand where article 15 requires it.

Register your personal-data bank with the Registro Nacional de Protección de Datos Personales before creating it, or, for a bank that predates the Law, declare it to the Authority within the deadline the regulation sets.

File a prior declaration of processing with the national commission, unless the processing is exempt, requires the commission's prior authorization under article 37, or requires a presidential decree issued after the commission's opinion under article 40.

Register with the supervisory authority as a data controller or data processor before processing personal data, and designate a data protection officer where article 40 requires one.

Implement technical and organisational measures giving a level of security appropriate to the risk, and cooperate with the Data Protection Authority in the performance of its tasks.

Carry out a data protection impact assessment before processing likely to result in a high risk, and consult the Data Protection Authority beforehand where the assessment shows that risk remains.

Notify the National Agency for the Protection of Personal Data (NAPPD) in writing at least eight days before starting a wholly or partly automated processing operation.

Obtain NAPPD's prior authorization before processing credit or solvency data, interconnecting personal-data files, or using collected data for a purpose other than the one it was collected for.

Declare your processing to the CDP before you start it, using its published form, and do not implement the processing until you receive the CDP's certificate of receipt.

Get the CDP's authorization before combining personal data files across purposes or processing a national identification number or other general-purpose identifier.

Appoint a written representative in Serbia when established outside Serbia and processing personal data of a person there, unless a listed exemption applies.

Carry out a data protection impact assessment before processing likely to create high risk to a person's rights and freedoms, and consult the Commissioner first where the assessment shows the risk cannot be brought down.

As a data controller of major importance, carry out a data protection impact assessment before processing likely to result in a high risk to a data subject, and submit the assessment report to the Authority before you start.

As a data controller of major importance, register with the Authority within six months of qualifying, and designate a data protection officer.

Obtain the Information Regulator's prior authorisation before linking data subjects' unique identifiers across responsible parties, processing criminal-behaviour or credit-reporting information, or transferring special personal information or a child's information to a country without adequate protection.

Keep a written or electronic register of your processing activities, covering the categories of data, recipients, retention periods, and security measures, and notify it to the Commissioner for Personal Data Protection, updating the notification whenever needed and at least once a year.

Run a documented impact assessment weighing public interest against individual privacy, and register the surveillance, before operating a camera or optical-electronic monitoring system in Sweden, whether or not it performs facial recognition.

Obtain a license or permit from the Personal Data Protection Authority before collecting, storing, transferring or processing personal data, and appoint a local representative if you are established outside Syria.

Register with the Personal Data Protection Commission before collecting or processing personal data.

Declare personal data processing to the Instance de Protection des Données à Caractère Personnel before implementing it, unless the processing is exempt from formalities, requires prior authorization, or requires a reasoned government opinion.

Obtain the Instance's prior authorization before interconnecting files that serve different purposes, processing a national identification number or other general purpose identifier, or processing personal data for a historical, statistical or scientific public interest purpose.

File a prior declaration with the National Authority for the Protection of Personal Data (INPDP) before processing personal data, or obtain its prior authorization where the Act requires one.

Tell the INPDP at least three months before permanently ceasing your processing activity, or within three months of a controller's death, bankruptcy or dissolution, so it can authorize the data's destruction.

Register with the National Information Technology Authority as a data controller or other prescribed person before collecting or processing personal data.

Notify the Ombudsperson before beginning to process biometric data, genetic data, health data, or another listed risky category of a person in Ukraine, under Article 7's notification-based mechanism; this law does not define biometric data anywhere, including in its Article 2 definitions.

Register any database of personal data you create, modify, or eliminate with the Unidad Reguladora y de Control de Datos Personales before operating it, and hold only the categories of data you declared in that registration.

If established outside Uruguay while offering goods or services to, or analyzing the behavior of, people in Uruguay, or using means located there, designate a locally domiciled representative before the Unidad Reguladora y de Control de Datos Personales.

Register with the Data Protection Commissioner as a data controller or data processor before controlling or processing personal data.

Tell the Data Protection Commissioner of any third-party agreement that lets a third party trade on a data subject's profile.

Notify the Authority before any wholly or partly automated processing operation, and notify it again of any modification to the information you gave.

State in that notification the date and the instrument permitting the processing, who you are, what the processing is called and what it is for, the categories of data and of data subjects, the safeguards on disclosure to third parties, how data subjects are informed and can exercise access, any linked processing, the retention period, an assessment of whether your security measures are adequate, any data processor you use, and the transfers you plan.

Comply with a formal notice the Autorité issues within the period it sets, which may not exceed eight days, before it moves to a sanction.

Do not obstruct the Autorité's investigations, and furnish it, its designated agents, or its members the information, documents, and premises access they request.

Comply with an order or notice served by the Privacy Commissioner under this Act.

Do not contravene the sensitive personal information restriction, and do not dispose of, alter, falsify, conceal or destroy evidence during a Commissioner investigation or inquiry.

Comply with an Agency order under Article 103, including a warning, a compliance order, a temporary or permanent restriction on processing, or a suspension of a transfer abroad, since defying one carries its own fine.

Comply with an ANPD warning's corrective-measures deadline before facing escalation to a fine, publicity of the infraction, blocking or deletion of the data involved, or suspension of the processing activity.

Cooperate with a CIL verification or control mission on site, including any expert it brings, and pay the mission's costs yourself if you were the one who requested the control.

Take all useful measures to facilitate the CIL's mission, and do not obstruct its action for any reason.

Submit a code of conduct to the CNPD before relying on it, and expect the CNPD to declare whether it complies with the data protection laws and regulations in force.

Interrupt, cease or block processing once notified to do so, cooperate with a CNPD request, and destroy personal data once its retention period under article 6 has elapsed, on pain of the penalty for qualified non-compliance.

Do not process personal data without complying with the prior declaration or authorization formalities the law requires before implementing the processing.

Cooperate with a warrant executed under section 52 to investigate a suspected contravention of the data protection principles or an offence under the Act.

Comply with an ANSICE warning or formal notice to cease a failure within the period ANSICE sets, on pain of a regulatory penalty and, for the underlying violation, criminal prosecution.

Meet the collection, purpose-limitation, sensitive-category, information, access-response, notification, declaration, and cross-border transfer conditions the law sets, each of which carries its own criminal exposure on breach.

Comply with lawful CAC and sectoral-regulator investigation, including document production and on-site inspection.

Comply with a warning or formal notice the Commission issues within the period it sets, no more than eight days, or face a pecuniary sanction, an injunction to stop the processing, withdrawal of an authorization, or a data lock, after a contradictory procedure.

Do not obstruct the Commission's action and take useful measures to facilitate its mission, including letting its members and agents access the premises where processing is carried out.

Respond to ARTCI's declarations, authorization requests, claims, complaints and audits, and comply with a warning or formal notice it issues within the time it sets.

Do not invoke professional secrecy against the Protection Body, whether you are a cryptologic service provider or the person responsible for the processing.

Do not obstruct the Data Protection Authority's on-site inspection, and expect a warning or a formal notice giving you no more than eight days to end a breach before a sanction follows.

Comply with a formal notice the Commission addresses to you, or expect an injunction, a withdrawal of authorization, the locking of the data concerned, or an administrative sanction of up to 70,000,000 Djiboutian francs or 5% of your worldwide turnover, whichever is higher, plus a daily penalty payment for continued non-compliance.

Expect the Personal Data Protection Center to decide a complaint against you within thirty working days of its submission, and carry out its decision within seven working days of being told of it, telling the Center once you have.

Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.

Cooperate with a Commission investigation, including giving evidence on summons and not obstructing entry and search of premises it reasonably suspects are connected with regulated activities.

Comply with an enforcement order the Authority serves within the period it specifies, which is never less than twenty-one days, then tell the data subject concerned and, where compliance materially modifies the data, anyone it was disclosed to in the twelve months before the order was served.

Furnish the Authority with information it requests, in a form that can be taken away and is intelligible and retrievable, and cooperate with it in discharging its powers and functions.

Produce any document the APDPVP's members or agents request for their mission, and let them access your programs and data for control purposes.

Do not obstruct an investigation by the Information Commission, which carries up to seven years of imprisonment.

Comply with an enforcement notice the Commission serves within the time it states, and rectify, block, erase, or destroy other data containing an opinion based on data the Commission finds was processed in contravention of the Act.

Comply with an information notice or enforcement notice the Commission issues after assessing a data subject's complaint about your processing.

Cooperate with an Information Commission investigation, complaint, information notice or warrant, and furnish the access, documentation and security information it requests.

Comply with an enforcement notice within the time it specifies, and where compliance materially modifies personal data, notify the data subject and anyone the data was disclosed to in the twelve months before the notice.

Comply with an enforcement notice, an assessment notice or an information notice from the Information Commissioner, and do not make a statement in purported compliance with one that you know, or recklessly disregard, to be false in a material respect.

On commencement, comply with a notice the Office issues after investigation requiring you, within a specified period, to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty of up to $100,000, proportionate to the violation's gravity, your efforts to comply, any profit made, and the harm caused.

On commencement, comply with any notice issued under sections 27 or 28 that is not under a duly made and ongoing appeal, or risk an offence carrying a fine of up to $100,000 and imprisonment of up to ten years, or both; that liability does not release or reduce any liability arising from the underlying notice.

Cooperate with an Agency inspection, including giving inspection officers access to documentation, computers, equipment and premises relevant to personal data processing.

Comply with a corrective order an inspection officer issues, which can require correcting irregularities, destroying, blocking or anonymising personal data, temporarily halting unlawful processing, or fulfilling a data subject's rights request.

Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.

Cooperate with a Commission investigation, including giving evidence on summons and not obstructing execution of a warrant issued to enter and search premises.

Obtain a license from the National Authority for Information Security and Safety before providing authentication services that involve collecting personal data.

Comply with any warning, injunction to stop processing, withdrawal of authorization, or monetary sanction the CMIL orders after an adversarial procedure, and with any urgent interruption or data-locking order it issues for up to three months.

Give CMIL inspectors on a control mission access to your premises between six in the morning and seven at night, unrestricted access to your files, processing, and equipment, and copies of any information they request.

Do not obstruct the Autorité de Protection des Données à Caractère Personnel's action, and take every measure useful to facilitate its work, including its information and on-site inspection missions.

Comply with an administrative sanction decision; the Autorité may use any technical means at its disposal to enforce it, though it may agree to settle a pecuniary sanction with you at your request, within the scales the law fixes.

Provide the competent authority, the Economic Policy, Planning and Statistics Office, with information it requests as needed for it to carry out its duties under this Chapter.

Comply with any regulation the competent authority makes, with Cabinet approval, to implement this Chapter.

Cooperate with the Authority's on-site inspections, and take all measures needed to facilitate its work rather than opposing its action.

Comply with an Authority warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of up to ten million ouguiya for a first breach, or up to fifty million ouguiya or five percent of turnover for a repeat breach within five years.

Answer the Centre's examination procedure once it is opened against you, and expect the sanctions the law provides at the end of it.

Comply with the Authority's formal notice to bring processing into conformity or to satisfy a data subject's rights request, within the period it sets, since noncompliance can draw a daily penalty of up to 10,000 euros that does not apply to the State or the Commune.

Cooperate with the Authority's checks and investigations, giving its members, agents, and sworn investigators the information, documents, and premises access they need, since only national security secrecy, attorney client privilege, journalistic source secrecy, and individual medical secrecy channelled through a designated physician can be raised against them.

Give the Agency's controllers access to your filing systems, files and electronic processing means on request, regardless of the level of data secrecy, under Articles 65 to 67, and comply with an Agency order to eliminate irregularities, stop unlawful processing, erase unlawfully collected data, or stop an unlawful transfer or entrusting of personal data, under Article 71.

Cooperate with the CNDP's investigations, give its commissioned agents access to your processing facilities, data, and documents, and comply with any order it issues to correct, block, erase, or destroy data, or to suspend or halt a processing operation.

Comply at once with a CNDP decision withdrawing your declaration receipt or authorization because your processing threatens public security or order or offends morality.

Comply with a compliance notice issued by the Commissioner to remedy a breach of the Act, an interference with privacy, or a breach of a code of practice, or face enforcement proceedings before the Human Rights Review Tribunal.

Do not obstruct, hinder, or resist the Commissioner, make a false or misleading statement, falsely claim authority under the Act, impersonate an individual to obtain or alter their personal information, or destroy a document to defeat a request; each is an offence carrying a fine of up to $10,000.

Cooperate with an accredited inspector's visit by allowing access to your data files, supplying the requested information and documents, including your registration and security measures, and allowing your equipment to be reviewed.

Comply with a HAPDP warning or formal notice to end a violation within the deadline it sets, or risk provisional or definitive withdrawal of your processing authorisation and a pecuniary sanction.

Give a control agent the HAPDP assigns access to the premises and installations where you carry out processing, other than a private home, to verify your compliance.

Attend a Pre-Action Conference as often as the Commission calls one in respect of a complaint or an investigation under section 46(3) of the Act.

Cooperate with the Personal Data Protection Agency's supervisors during a regular, irregular or control supervision, including granting access to premises, documents and equipment relevant to personal data processing.

Cooperate with ANTAI's information requests and inspections and respond to its formal notices and observations; failing to do so is itself a serious infraction.

Register your personal-data bank in the Registro Nacional de Protección de Datos Personales, and expect any cross-border data-flow communication, sanction, or precautionary or corrective measure to be recorded there too.

Comply with an accessory obligation the sanctioning procedure imposes within its deadline, or expect a coercive fine of up to 10 UIT on top of the underlying sanction.

Comply with the supervisory authority's oversight, including its inspections, its register of data controllers and processors, and any regulation it issues to implement this Law.

Furnish the Information Commissioner with access to personal data, documentation of its processing, or information about its security, in writing within the time an information notice specifies.

Comply with an enforcement notice the Information Commissioner serves within the time it states, and notify the data subject and anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying, if compliance materially modifies the data.

Answer the Authority's requests for information and documents, and expect verifications, including the special verifications article 63 provides for.

Cooperate with the CDP's on-site inspections and give its members or agents any document they need for their mission.

Comply with a CDP warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of one million to one hundred million CFA francs.

Comply with an order of the Authority, or apply to the Supreme Court for judicial review within thirty days: failing to comply is an offence carrying the same fine and up to two years' imprisonment.

Comply with an enforcement notice the Regulator serves requiring you to take, or stop taking, specified steps, or appeal it to the High Court within 30 days.

Cooperate with the Commissioner for Personal Data Protection, an independent authority the bill would establish, including by giving access to the records, information, and premises the Commissioner needs to investigate a complaint.

Comply with a stop order the Director General serves within the period it specifies, or expect the Board to warn of, suspend, or revoke your license, permit or accreditation, publish the violation at your expense, or place you under the Authority's technical supervision.

Comply with a warning or formal notice the Instance issues within the period it sets, or face a provisional or, ultimately, definitive withdrawal of your authorization, an administrative fine of up to XOF 100,000,000, interruption of the processing, data locking, or a daily penalty of up to XOF 5,000,000, after a hearing.

Do not obstruct the Instance's action by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match your records.

Comply with an enforcement notice the Privacy Commission serves on you, and with an information notice in an investigation.

Cooperate with the INPDP's investigations, let it take statements and inspect the premises where processing took place other than a private home, and do not obstruct its work or give it inaccurate information in bad faith.

Provide a document or information the Deputy Commissioner requests in writing to determine whether the Act has been contravened, within 14 days of receiving the request.

Do not destroy, conceal, alter or falsify personal data or other material to prevent its disclosure to a data subject or to the Deputy Commissioner.

Obtain a data controller licence from the Data Protection Authority before processing personal information, if you decide the means, purpose or outcome of processing, decide what data to collect or from whom, or obtain commercial gain from the processing.

Appoint a certified data protection officer and notify the Authority of the appointment in writing.

Apply to the Data Protection Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.

Get the Authority's prior authorization before processing genetic data, health-related research data, data on criminal offences or convictions, or biometric data.

As an administrative or judicial authority acting in the exercise of your public powers, do not process genetic or biometric data for authentication or identity control without first obtaining the Authority's opinion, and store the raw biometric data separately from any template derived from it.

Where you process health data solely for preventive medicine, medical diagnosis, care, or health service management under a practitioner's or an equally bound person's professional secrecy, file a declaration with the CNDP rather than seeking its prior authorization.

Obtain the HAPDP's prior authorization before any processing of biometric data, and ensure it responds to a specific, justified necessity with safeguards under this law.

Get the Agency's prior approval before processing health data, genetic data or biometric data of a person in North Macedonia, including where the processing rests on the data subject's own explicit consent, unless the processing is determined by a law that itself provides safeguards or the genetic data is processed by an expert for preventive medicine, diagnostics or treatment.

Do not operate a credit-reporting or credit-information business, or otherwise collect, hold or disclose a person's credit data, without meeting this law's registration, disclosure and administrative obligations, on pain of a fine, a suspension, or a closure of the data-processing operation.

An app processing a data category the PDPPL treats as special in nature (ethnic origin, children's data, health, physical or psychological condition, religious creeds, marital relations, or criminal offenses) about an individual in Qatar must obtain permission from the Competent Department; Qatar's PDPPL does not currently name biometric data as its own special-nature category, so an app processing a voiceprint or faceprint should not assume this permission requirement applies without a further check of any ministerial decision that may have added it.

Obtain the national commission's prior authorization before processing personal data bearing on genetic data or health research, offence, conviction or security-measure data, or biometric data.

Where you process health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management, do so only through a health professional or another person bound by professional secrecy, notify NAPPD of the processing, and secure it with appropriate information-security measures.

Obtain NAPPD's prior authorization before processing sensitive personal data under the public-interest ground, and before processing data on a person suspected of a crime or an administrative offense, or on a penalty, security measure, fine or ancillary sanction imposed on them.

Get the CDP's prior authorization before processing genetic data, health-related research data, data on criminal offences or convictions, or biometric data.

Treat biometric data, race, clan or ethnic origin, religious belief, health status, marital status or sex life, and political opinion or affiliation as sensitive personal data, and apply the measures the Data Protection Authority prescribes by regulation for processing it.

Do not process sensitive personal data, including a psychological, mental, physical or genetic health condition or a biometric identifier such as a voiceprint or faceprint, without a license or permit from the Personal Data Protection Authority.

Obtain the Instance's prior authorization before processing genetic data, health research data, biometric data, or data on criminal offenses, convictions or security measures.

Get the INPDP's separate authorization, decided within thirty days, before processing a special category of data under article 14, except health data.

Get the INPDP's authorization before a physician shares health data with a research body, and never keep or use health data beyond the time its purpose requires.

Before making a commercial telephone solicitation call or message to a person in Oklahoma, register as a commercial telephone seller with the Attorney General at least ten days beforehand and file a $10,000.00 surety bond, unless an exemption in Section 775A.2 applies to you.

If you cause or attempt a telephone solicitation of a business opportunity, or represent that a buyer will receive additional units without further cost or a prize or gift for buying or paying, a below-market price because of an unusual event or imminent price increase, or a seller, manufacturer or supplier other than the real one, or you sell gold, silver, other precious metals, precious stones, or an interest in oil, gas or a mineral field, well or exploration site by telephone, register with the Department of Justice at least 10 days before doing business in Oregon and pay the $400 annual fee, whether you call from Oregon or into Oregon.

Register with the Office of Attorney General, with a $50,000 surety bond, at least 30 days before offering consumer goods or services for sale, and before you or your telemarketers initiate or receive a telemarketing call or message with a Pennsylvania subscriber, unless an exemption applies (among others, a business licensed by or registered with a federal or Commonwealth agency acting within that licence, a qualifying catalog seller, an established business-to-business seller, or a seller calling its own past purchasers after three years under one name).

Before using an automated dial announcing device to make a call that originates or terminates in Texas, obtain a Public Utility Commission permit, renewed annually, and, before using it to play a recorded message on connection, give written notice of the device to each telecommunications utility over whose system it will be used.

Notify the commission by certified mail at least 48 hours before changing the device's telephone number or physical address.

Before making a telephone solicitation (a call or other transmission, a text message included) from a location in Texas or to a purchaser in Texas, register each business location with the Texas Secretary of State on a verified registration statement with a $200 filing fee and $10,000 in security (a bond, letter of credit, or certificate of deposit), renew annually, and file a quarterly addendum listing the salespeople who solicited for you.

Before completing a telephone-solicited sale, give the purchaser the disclosures section 302.202 requires, post the registration certificate at the business location, and do not refer to your compliance with the chapter.

Register with the Washington Department of Licensing before doing business in the state as a commercial telephone solicitor, whether you solicit from a location in Washington or solicit purchasers located in Washington, and before maintaining or defending a lawsuit here.

Do not have a salesperson solicit purchasers on your behalf while your registration is not current.