the entity that determines the purposes, conditions and means of the processing of personal data.
freely given, specific, informed and explicit permission by statement or action signifying agreement to the processing of their personal data.
THRESHOLDS FOR MANDATORY REGISTRATION (r. 13(3))
A data controller or data processor processing personal data for the following
purposes shall register as a data controller or a data processor as provided for under these
Regulations—
1. Canvassing political support among the electorate.
2. Crime prevention and prosecution of offenders (including operating security
CCTV systems).
3. Gambling.
4. Operating an educational institution.
5. Health administration and provision of patient care.
6. Hospitality industry firms but excludes tour guides.
7. Property management including the selling of land.
8. Provision of financial services.
9. Telecommunications network or service providers.
10. Businesses that are wholly or mainly in direct marketing.
11. Transport services firms (including online passenger hailing applications)
12. Businesses that process genetic data.
Fees charged by office(r. 5(2)(b)
18.
A data controller or a data processor who—
(a) processes personal data without registering in accordance
with these Regulations;
(b) provides false or misleading information for the purpose of
registration; or
(c) fails to renew a certificate of registration and continues to
process personal data after the expiry of the certificate,
commits an offence and shall, upon conviction, be liable to
penalty specified under section 73 of the Act.
17.
An application made under these Regulations shall be
submitted through electronic means provided for on the Office website.
