According to Article 21 of the Personal Data Protection Act, data processing entities should, within 8 days the beginning of data processing, notify the PDPB in writing of its automatic personal data processing. After receiving the notification, the PDPB will register it to a database for public access. In other words, the notification will serve as a registration and a record for public access. If, in the notification from the employer, data combination (see Article 9 and 22 of the Act) is found at issue without authorization of the PDPB, or transfer of personal data outside the MSAR (see Article 19 and 20 of the Act) without this Bureau's review, it will be regarded as non-compliance with the law. In this case the Bureau may, by virtue of Article 23 of the Act, demand that the employer concerned provide specific information required by law (such as type of data, purposes and security measures of the data processing, among other things ), in order to take follow-up measures in accordance with the law.