• DATA 4.2 DATA 4.2 Notifications

    • DATA 4.2.1

      For the purposes of Article 17(2)(B) of the Data Protection Regulations, a Data Controller must notify the QFC Authority of any of the following Personal Data Processing operations undertaken other than in accordance with a permit issued by the QFC Authority:

      (A) any Personal Data Processing operation or set of operations involving the Processing of Sensitive Personal Data; and
      (B) any Personal Data Processing operation or set of operations involving the transfer of Personal Data to a Recipient outside of the QFC which is not subject to laws and regulations which ensure an adequate level of protection.
      Derived from QFC RM01/2005 (as from 17th October 2005).

    • DATA 4.2.2

      When a Data Controller gives a notification to the QFC Authority in accordance with DATA Rule 4.2.1, the notification must contain the following information:

      (A) the name of the Data Controller;
      (B) the address of the Data Controller;
      (C) the name, address, telephone number, fax number and e-mail address of the Person within the Data Controller responsible for making the application for the permit;
      (D) the reason for which notification is being provided;
      (E) a general description of the Personal Data Processing being carried out;
      (F) an explanation of the purpose of the Personal Data Processing;
      (G) the Data Subjects or class of Data Subjects whose Personal Data is being processed;
      (H) a description of the class of Personal Data being processed; and
      (I) a statement of which jurisdictions to which Personal Data will be transferred by the Data Controller, along with an indication as to whether the particular jurisdiction has been assessed as having adequate level of protection for the purposes of Articles 9 and 10 of the Data Protection Regulations.
      Derived from QFC RM01/2005 (as from 17th October 2005).

    • DATA 4.2.3

      The notification required by DATA Rule 4.2.1 must be provided to the QFC Authority:

      (A) immediately upon commencing of the Personal Data Processing referred to in DATA Rule 4.2.1;
      (B) on an annual basis where the Personal Data Processing is to continue in the subsequent year; and
      (C) immediately upon any Personal Data Processing being processed in a manner different to that described in the initial notification.
      Derived from QFC RM01/2005 (as from 17th October 2005).

    • DATA 4.2.4

      The annual notification in DATA Rule 4.2.3(B) must be submitted to the QFC Authority within four months of the Data Controller’s financial year end.

      Derived from QFC RM01/2005 (as from 17th October 2005).