Customer lists, member databases, employee HR and health check records: almost every company holds personal data. Taiwan's Personal Data Protection Act (PDPA) governs how that data is collected, processed and used, and requires companies that hold it to take appropriate security measures[1]. The law is in transition: amendments promulgated on 11 November 2025 add new duties such as reporting personal data incidents, but their effective date has yet to be set by the Executive Yuan[2], so it is easy to mistake the not-yet-effective text for the law in force.

This guide is for managers, IT staff and legal teams at Taiwan companies who handle customer or employee personal data. It collects the obligations in one place, from a security angle: which version applies today, what counts as personal data, what legal basis collection and use need, what security and outsourcing require, what to watch when data leaves Taiwan, and the notification, reporting and penalties that apply when something goes wrong. For the steps to take during a breach, see Responding to a Personal Data Breach. This is a general overview, not legal advice; confirm specific cases with counsel.

Where the law stands: the text in force and the pending 2025 amendments

The version in force is the one promulgated on 31 May 2023[1]. That amendment added Article 1-1, which names the Personal Data Protection Commission (PDPC) as the competent authority, but left that article's effective date to the Executive Yuan; it also amended the penalties in Article 48, which took effect on promulgation[2]. Since 1 January 2024, the responsibilities under Articles 53 and 55 that the National Development Council used to hold have been transferred to the PDPC Preparatory Office[2]. Inspections and penalties against companies are still handled by the central competent authority for the industry or by the municipal or county (city) government under the text in force[1].

The amendments promulgated on 11 November 2025 amend Articles 1-1, 12, 18, 21, 22 to 26, 41 and 47 to 49, among others; add Articles 1-2, 20-1, 21-1 to 21-5, 51-1 and 53-1; and delete Article 27. Their effective date is to be set by the Executive Yuan[2]. The Laws & Regulations Database (updated to 6 November 2026) still marks the PDPA as "some or all articles not yet in effect; final effective date: undetermined"[2]. Be careful when looking up the text: the database's "all articles" page shows the 2025 amended wording, and the provisions currently in force are reached through the link to the previous version[3]. Unless stated otherwise, the article numbers and content cited in the rest of this guide are from the text in force.

The PDPC itself has not been set up yet. The Preparatory Office's Q&A on the amendments explains that the PDPC needs its own organization act as its legal basis and only gains its statutory powers once that act is passed; until then, ministries and local governments continue to supervise the non-government entities under them under the current PDPA. The Executive Yuan will set the effective date of the 2025 amendments after the organization act is passed, taking into account the administrative work needed to set up the PDPC and the readiness of key implementing regulations; until then, the PDPA in force continues to apply[4]. At the time of writing, the official website still operates under the name "Personal Data Protection Commission Preparatory Office"[5].

What the 2025 amendments will change (not yet in force)

  • Breach notification no longer depends on a violation: the new Article 12 requires notifying data subjects once an entity "becomes aware" that personal data it holds has been stolen, altered, damaged, lost or leaked; when an incident meets the reporting threshold, non-government entities must report to the competent authority, take immediate and effective response measures, and record the facts and keep the records[3].
  • Security moves to a common regulation: Article 27 is deleted and replaced by Article 20-1, which requires non-government entities to carry out security maintenance, with details set by the competent authority in a common baseline regulation[3][6].
  • Supervision gradually centralized in the PDPC: Article 51-1 creates a transition period. For six years after the PDPC is established, non-government entities within a scope announced by the Executive Yuan remain under their central competent authority or local government, with the scope reviewed and reduced every two years; entities outside that scope are supervised by the PDPC[3][4].
  • The power to restrict cross-border transfers moves to the competent authority (Article 21)[3].
  • Government agencies must appoint a personal data protection officer; the Q&A notes that the new law does not require non-government entities to do so[4].
  • Penalties: breaching the duty to notify data subjects leads first to an order to correct, then repeated fines of NT$20,000 to NT$200,000 per instance if not corrected; breaching the reporting, response or record-keeping duties leads directly to a fine of NT$20,000 to NT$200,000 and an order to correct[4].

On 22 January 2026 the Preparatory Office pre-announced two draft regulations, the Personal Data Incident Notification, Reporting and Response Regulations and the Personal Data File Security Maintenance Regulations[7][8]. On the same day it pre-announced amendments to the Enforcement Rules, and on 6 February 2026 a draft list of the non-government entities within the Article 51-1 scope[5]. The draft incident regulations require individual notice to data subjects within 72 hours of becoming aware of an incident, and a report to the competent authority within 72 hours when the incident involves sensitive personal data, involves an information system holding 10,000 or more records, or affects 100 or more records[7]. The draft security regulations have two tiers: common measures for all entities, and enhanced measures for government agencies and "large non-government entities" (not a small or medium-sized enterprise, and holding 10,000 or more personal data records), such as a security maintenance plan, an internal audit every year, and a yearly audit of contractors[8]. Drafts become binding only after the amended Act takes effect and the regulations are formally issued, and their content may change.

Key concepts: personal data, sensitive data and non-government entities

Under the PDPA, personal data means a natural person's name, date of birth, national ID number, passport number, features, fingerprints, marital status, family, education, occupation, medical records, medical treatment, genetic information, sex life, health checks, criminal records, contact information, financial status, social activities, and any other data that can directly or indirectly identify that person[1]. The Enforcement Rules add that a "person" means a living natural person, and that "indirectly identify" means the holder cannot identify the person from the data alone but can do so by comparing, combining or linking it with other data[9]. So data where member numbers replace names, while the company still holds the lookup table, should still be managed as personal data. The Enforcement Rules also state that personal data files include backup files[9], so do not leave backups and exported copies out of your inventory.

Sensitive personal data

Six categories (medical records, medical treatment, genetic information, sex life, health checks and criminal records) may not be collected, processed or used except in the situations listed in Article 6, for example where the law expressly provides for it, where it is necessary to perform a legal obligation and appropriate security measures are in place, where the data subject made it public or it was lawfully made public, or with the data subject's written consent; however, written consent alone is not enough where the processing goes beyond what the specific purpose requires, where another law restricts it, or where the consent is against the person's will[1]. The Enforcement Rules define these categories: for example, "sex life" means sexual orientation or sexual habits, "criminal records" means records of deferred prosecution, non-prosecution at the prosecutor's discretion, or a final conviction and its execution, and "health checks" means data produced by medical examinations not aimed at diagnosing or treating a specific disease[9]. The case companies meet most often is employee health check reports, which should be stored separately with tightly limited access.

Non-government entities

The PDPA divides those it regulates into government agencies and non-government entities. Government agencies are central or local agencies, or administrative corporations, that exercise public authority under law; every other natural person, legal person or group is a non-government entity and falls under Chapter 3 on collection, processing and use by non-government entities[1]. Ordinary companies, foundations, associations and sole proprietorships are all included. Processing personal data purely for personal or household purposes is outside the PDPA, while collecting, processing or using the personal data of ROC nationals outside ROC territory is still covered[1].

Collection and use: legal basis, notice and data subject rights

All collection, processing and use must respect the data subject's rights and interests, be done in good faith, not exceed what the specific purpose requires, and have a legitimate and reasonable connection to the purpose of collection (Article 5)[1].

Legal basis: Articles 19 and 20

A non-government entity collecting or processing ordinary personal data needs a specific purpose and one of the grounds in Article 19(1): an express legal provision; a contract or quasi-contractual relationship with the data subject, with appropriate security measures in place; data the data subject made public or that was lawfully made public; statistics or academic research in the public interest by an academic research institution; the data subject's consent; necessity to further the public interest; data obtained from generally available sources; or no harm to the data subject's rights and interests[1]. Security teams should note that the contract ground, the one companies rely on most, is itself conditional on "appropriate security measures" having been taken[1].

Use is in principle limited to what the specific purpose of collection requires. Use beyond that purpose is allowed only in the situations listed in Article 20(1), for example where the law expressly provides for it, to prevent danger to the data subject's life, body, freedom or property, or with the data subject's consent[1]. When personal data is used for marketing, the company must stop as soon as the data subject refuses, and must provide a way to refuse marketing at the first marketing contact and pay the cost of doing so[1].

Consent must be obtained after the required notice. Consent to use beyond the original purpose must be given separately, after the person has been clearly told the other purpose, its scope and the effect of consenting or not, and the collector bears the burden of proving consent (Article 7)[1]. The Enforcement Rules allow written consent to be obtained as an electronic document under the Electronic Signatures Act, and where it sits in the same document as other declarations, it must be placed so that the person can see and confirm it[9]. For IT, this means consent records (time, version, content and channel) must be kept and retrievable.

Notice: Articles 8 and 9

When collecting directly from the data subject, the company must clearly state six things: its name; the purpose of collection; the categories of data; the period, area, recipients and manner of use; the rights the data subject can exercise and how; and, where providing the data is optional, the effect of not providing it. Notice can be skipped where the law exempts it, where collection is necessary to perform a legal obligation, where the data subject already knows the content, and in some other cases[1]. For personal data not provided by the data subject (for example a list passed on by a partner), the company must tell the person the source and items one to five above before processing or using it, and may do so together with the first use[1]. Notice can be given orally, in writing, by phone, text message, email, fax, electronic document or similar means[9].

Data subject rights: Articles 3, 10 and 11

Data subjects have the right to make inquiries and request access, request copies, request supplementation or correction, request that collection, processing or use stop, and request deletion; these rights cannot be waived in advance or limited by contract[1]. Companies must answer inquiries and provide access or copies on request (with exceptions such as harm to national security or to a third party's significant interests) and keep personal data accurate. When the specific purpose no longer exists or the retention period has expired, they must delete the data or stop processing or using it, on their own initiative or on request, unless it is necessary for their business or the data subject has consented in writing; unlawfully collected data must also be deleted or no longer used[1]. Inquiry and access requests must be decided within 15 days and correction or deletion requests within 30 days; each deadline can be extended once by up to the same number of days, with the reason given in writing (Article 13)[1]. The Enforcement Rules explain that "necessary for business" includes retention periods set by law or by contract[9]. In practice, a company needs to know which systems, backups and vendors hold each person's data, or it will struggle to answer inquiries or complete deletions on time.

Security, outsourcing and cross-border transfers

Article 27 and Enforcement Rules Article 12

Article 27 of the text in force requires non-government entities that hold personal data files to take appropriate security measures to prevent personal data from being stolen, altered, damaged, lost or leaked. The central competent authority may designate entities that must draw up a personal data file security maintenance plan or a method for handling personal data after business termination, and may set standards for them by regulation[1]. Enforcement Rules Article 12 explains that "appropriate security measures" are technical and organizational measures taken to prevent those outcomes, proportionate to the protection goal, and may include 11 items: assigning managers and adequate resources, defining the scope of personal data, risk assessment and management, incident prevention, reporting and response, internal management procedures, data security and personnel management, awareness and training, equipment security, data security audits, keeping usage records, logs and evidence, and continuous improvement[9].

Sector regulations: the Ministry of Digital Affairs example

Each central competent authority may issue its own security regulations under Article 27(3). One example is the Ministry of Digital Affairs (MODA) regulation for digital-economy industries, issued on 12 October 2023, which applies to the industries listed in its Annex 1: online retail (e-commerce), software publishing, computer programming and consultancy, data processing and hosting, other information services, and third-party payment services[10]. Covered businesses had to adopt a security maintenance plan within three months of the regulation taking effect. Where they process personal data in information systems, they must deploy firewalls, email filtering or intrusion detection and keep them updated, monitor for abnormal access and rehearse their response, regularly test for and address system vulnerabilities, enforce password complexity, avoid real personal data in testing, and consider masking; records of collection, processing and use, system logs and evidence of implementation must be kept for at least five years[10]. Businesses with paid-in or registered capital of NT$10 million or more, or holding 5,000 or more personal data records, must carry out and review certain measures at least once every 12 months[10].

Companies outside that list should check whether their own central competent authority has a similar regulation. The Q&A explains that during the transition period after the 2025 amendments take effect, sector regulations made under the current Article 27(3) can remain valid, but parts that differ from the new law (such as incident reporting) must be amended[4].

Outsourcing: the contractor is treated as the commissioning party

Anyone commissioned to collect, process or use personal data is, within the scope of the PDPA, treated as the commissioning party (Article 4)[1]. The contractor follows the rules that apply to the commissioning party, and the commissioning party must supervise the contractor appropriately[9]. Enforcement Rules Article 8 sets out the minimum points of supervision: the planned scope, categories, specific purpose and period of collection, processing or use; the security measures the contractor takes; any sub-contractors; what the contractor must report to the commissioning party, and the remedial measures to take, if it or its staff breach personal data rules; any instructions the commissioning party reserves; and, when the relationship ends, the return of data carriers and deletion of personal data the contractor stores. The commissioning party must also check the contractor's performance regularly and record the results, and the contractor may only process personal data within the commissioning party's instructions[9]. The MODA regulation further requires these points to be spelled out in the outsourcing contract or related documents[10].

In its explanatory notes to the draft incident regulations, the Preparatory Office notes that if a contractor fails to notify the commissioning party, the PDPA cannot penalize the contractor directly; instead the commissioning party is treated as having breached the notification or reporting duty, and the two sides settle it under their contract[7]. This is only a draft note, but it reflects reality: when your vendor has an incident, you are the one facing data subjects and regulators. Write the Enforcement Rules Article 8 supervision points into contracts, and add an incident notification deadline, audit rights and proof of deletion at the end of the relationship; for other aspects of vendor risk, see Supply Chain Attacks.

Cross-border transfers: Article 21

A cross-border transfer means processing or using personal data across national borders[1]. The text in force does not require prior approval; instead, it lets the central competent authority restrict transfers in four situations: where major national interests are involved; where an international treaty or agreement has special provisions; where the receiving country lacks sound personal data protection laws, so that data subjects' rights may be harmed; or where data is routed through a third country (or region) to evade the PDPA[1]. One example is the Ministry of Health and Welfare (MOHW) announcement restricting western pharmaceutical wholesalers and retailers from transferring data subjects' personal data to mainland China, Hong Kong and Macao; on 3 July 2026 the MOHW issued the standard contractual clauses referred to in that announcement's annex, effective 1 October 2026[11]. Breaching a restriction order can bring a fine of NT$50,000 to NT$500,000, and doing so with intent to gain unlawfully, causing harm to others, is also a crime[1].

Before putting data in an overseas cloud or handing it to an overseas vendor, check whether your competent authority restricts it. The MODA regulation also requires businesses to tell data subjects which regions their data will be transferred to, and to supervise the recipient's scope, purpose and period of processing and how data subjects can exercise their rights[10].

Breach notification, reporting and liability

Article 12 in force: notifying data subjects

Article 12 of the text in force provides that where a violation of the PDPA leads to personal data being stolen, leaked, altered or otherwise infringed, the entity must notify the data subjects by appropriate means after investigating[1]. Enforcement Rules Article 22 explains that "appropriate means" are prompt notice orally, in writing, by phone, text message, email, fax, electronic document or other means through which the data subject can learn of it; where that would be excessively costly, the entity may, considering technical feasibility and privacy, use the internet, news media or other appropriate public means instead; and the notice must include the facts of the infringement and the measures taken in response[9]. For how to scope the incident, preserve evidence and write the notice, see Responding to a Personal Data Breach.

Do you have to report to an authority?

The PDPA in force has no provision on reporting to an authority; whether you must report depends on whether your industry's security regulations require it[1]. Under the MODA regulation, for example, businesses in the Annex 1 industries that suffer a personal data security incident that will endanger their normal operations or the rights of a large number of data subjects must report to MODA within 72 hours of becoming aware of it using the Annex 2 form, or report to the municipal or county (city) government and copy MODA; if they cannot report in time or cannot provide all the information at once, they must give the reasons for the delay or report in stages[10]. This 72-hour rule applies only to businesses covered by that regulation; for other industries, the thresholds and deadlines depend on their own authority's regulation. A general duty to report to the PDPC will only arise once the amended Article 12(2) takes effect[3].

How this relates to the Cyber Security Management Act and listed-company rules

The Cyber Security Management Act applies to government agencies and specified non-government entities (critical infrastructure providers, state-owned enterprises, specified foundations, and enterprises, groups or institutions controlled by the government), and deals with the confidentiality, integrity and availability of information systems and information[12]. The PDPA applies to every company that handles personal data and is not limited to information systems: comparing the two audit regimes, the Q&A notes that audits under the Cyber Security Management Act target data security in information and communication systems, while the PDPA is not limited to those systems or to security, and also covers whether collection, processing and use are lawful and whether data subjects can exercise their rights[4]. For a company that is a specified non-government entity, one personal data breach can trigger duties under both laws; for the cyber security reporting deadlines, see Taiwan's Cyber Security Management Act. Listed companies must also assess whether to file a material information announcement, see Cyber Incident Disclosure by Taiwan-Listed Companies, and for day-to-day security controls see the TWSE Cybersecurity Control Guidelines.

Penalties and damages

Under the text in force, administrative penalties are imposed by the central competent authority or the municipal or county (city) government[1]:

  • Breaching the rules on sensitive data, collecting or processing without an Article 19 ground, using data in breach of Article 20(1), or breaching a cross-border transfer restriction: a fine of NT$50,000 to NT$500,000 and an order to correct, with repeated fines if not corrected (Article 47).
  • Breaching the rules on notice (Articles 8 and 9), data subject rights (Articles 10, 11 and 13), breach notification (Article 12) or marketing refusal (Article 20(2) and (3)): first an order to correct, then repeated fines of NT$20,000 to NT$200,000 per instance if not corrected (Article 48(1)).
  • Failing to take appropriate security measures, or failing to draw up a designated security maintenance plan or post-termination handling method: a fine of NT$20,000 to NT$2 million and an order to correct, then repeated fines of NT$150,000 to NT$15 million if not corrected; in serious cases, a fine of NT$150,000 to NT$15 million straight away (Article 48(2) and (3)).
  • When a company is fined, its representative, manager or other person with authority to represent it receives a fine of the same amount unless they can prove they did their duty to prevent the violation (Article 50). The authority can also prohibit collection, processing or use, order deletion, confiscate or order the destruction of unlawfully collected data, and publish the violation together with the company's name and the name of the person in charge (Article 25).

Before the 2023 amendment, a security failure first led to an order to correct, with repeated fines of NT$20,000 to NT$200,000 only if it was not corrected in time[13]; now a fine can be imposed without first giving time to correct, and the maximum has risen to NT$15 million[1].

On civil liability, a non-government entity that breaches the PDPA and causes personal data to be unlawfully collected, processed or used, or otherwise infringes data subjects' rights, is liable for damages unless it can prove it acted without intent or negligence[1]. Where victims cannot easily prove their actual loss, they may ask the court to award NT$500 to NT$20,000 per person per incident depending on the circumstances; where one set of facts harms many data subjects, the total is capped at NT$200 million, unless the interest involved exceeds NT$200 million, in which case the cap is that interest[1]. A qualifying foundation or public-interest association authorized in writing by 20 or more affected data subjects can bring a group action in its own name[1].

On criminal liability, anyone who, intending to obtain an unlawful benefit for themselves or a third party or to harm another's interests, breaches the rules on sensitive data, on collection, processing or use, or a cross-border transfer restriction, causing harm to others, faces up to five years' imprisonment and a fine of up to NT$1 million (Article 41), and prosecution does not require a complaint[1]. With the same unlawful intent, altering or deleting personal data files, or otherwise impairing their accuracy, in a way that causes harm to others, also carries up to five years' imprisonment (Article 42)[1].

Action checklist

  1. Assign someone to track the effective date of the PDPA amendments and the final implementing regulations (PDPC Preparatory Office website, Laws & Regulations Database); until then, base all internal procedures and training on the text in force.
  2. Inventory personal data: what each system, file, backup, export and vendor holds, the specific purpose and legal basis for each, with sensitive personal data flagged separately.
  3. Check that the privacy notice on every collection channel covers the six items in Article 8, that people on indirectly obtained lists are notified before processing or first use, and that consent records are kept so you can meet the burden of proof.
  4. Set up a data subject request process: identity checks, finding and deleting data across systems, the 15-day and 30-day decision deadlines, and how to reply when retention periods prevent deletion.
  5. Identify your central competent authority and its security regulation, close the gaps against the 11 measures in Enforcement Rules Article 12, and if you meet the regulation's thresholds, put the recurring implementation and review into your annual plan.
  6. Compare every outsourcing contract with Enforcement Rules Article 8, add an incident notification deadline, audit rights and proof of return and deletion at the end, and regularly check and record the vendor's performance.
  7. List every overseas cloud service and overseas vendor, check whether your competent authority restricts the transfer, and name the destination regions in your privacy notice.
  8. Write a procedure and template for notifying data subjects under Article 12 and Enforcement Rules Article 22, and confirm your sector regulation's reporting threshold and deadline; for response steps see Responding to a Personal Data Breach. If you need outside help reviewing the protection of systems that hold personal data, see our security health check service.

This guide is a general overview, not legal advice; actual obligations depend on the text in force in the Laws & Regulations Database, the rules of your central competent authority and case-by-case interpretation.