The regulation of transborder data flows is a vital legal process designed to protect personal data. The need for protection is growing in the current information society but the data protection laws are sometimes vague and ambiguous. The first part of this thesis examines the Macau Special Administrative Region data protection legal framework. Surprisingly, the supervisory data protection authority in the Region is a temporary project team and its independence is questioned. A detailed analysis of the most important international instruments is made on the second part of the thesis, with emphasis on the Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The Macau Special Administrative Region Personal Data Protection Act is influenced by the Portuguese Data Protection Act that transposed the Directive. Therefore, the Directive is an important tool to understand some of the concepts of the Macau Special Administrative Region Data Protection Act that are discussed on the third part of the thesis, in particular the concepts of “adequate protection”, “unambiguous consent” and “adequate safeguards”. The third part identifies several problems of the regulatory model followed by the Macau Special Administrative Region such as the lower level of compliance and the insufficient enforcement of the Law. Therefore, in the last part of the thesis I explore the models followed by other legal systems. Finally, I reach the conclusion that the Macau Special Administrative Region should continue to adopt the regulatory model but amendments to the Data Protection Act and to the nature of its supervisory authority have to be made.