Taiwan Personal Data Protection Act (PDPA)

Why does it matter?

The PDPA matters because Taiwan is moving from supervision by many industry regulators to one independent authority, and because liability is concrete. A company that loses personal data answers to its sector regulator for fines under Article 48, can face a civil claim of NT$500 to NT$20,000 per person per incident under Articles 28 and 29 without proof of actual loss, and can be sued by a registered foundation or charity on behalf of at least 20 data subjects under Article 34. The responsible representative can be fined too under Article 50.

Key benefits include:

• Defined legal bases

Article 19 allows collection by a non-government agency only for a specific purpose and on one of eight bases, such as a statute, a contractual or quasi-contractual relationship, consent, or publicized data.

• A fixed notice

Article 8 lists six items to give the data subject at collection, from the agency's name and purpose to the recipients, the person's rights and the effect of not providing the data.

• Time limits on requests

Article 13 gives 15 days to accept or reject an access request, extendable by 15, and 30 days for correction or deletion requests, extendable by 30.

• Heavier security penalties

Article 48 sets fines of NT$20,000 to NT$2,000,000 for security failures, then NT$150,000 to NT$15,000,000 successively until the violation is rectified.

• Group damages claims

Articles 28 and 29 cap total compensation for one incident at NT$200 million, unless the interests involved are larger, and Article 34 lets qualifying foundations bring the claim.

How does it work?

The PDPA protects personal data in four steps. A specific purpose is set before collection (Article 5 limits processing to the necessary scope with a legitimate connection to that purpose), Article 8 or Article 9 notice goes to the data subject, and use stays within that purpose unless Article 20 allows another, for example consent, a legal requirement or the data subject's benefit. The consent standard in Article 7 is a declaration made after being informed, a separate one for another purpose, and the collector bears the burden of proof. Marketing use stops when the person objects (Article 20, paragraphs 2 and 3).

Data about medical records, healthcare, genetics, sex life, physical examination and criminal records is restricted by Article 6 and may be handled only on its listed bases, for example where a law requires it or the data subject consents in writing. Data subjects hold five rights under Article 3: to inquire and review, to receive a copy, to supplement or correct, to demand cessation, and to erasure. Article 4 treats a person commissioned to process data as acting for the commissioning agency, so the agency stays responsible.

For breaches, the in-force Article 12 requires telling the data subject after the facts are clarified, and Article 27 requires a non-government agency holding personal data files to adopt security measures, with industry regulators able to require a security plan and rules for data after a business ends. The November 2025 amendment replaces this: Article 12 adds a report to the competent authority within a scope the authority sets, immediate countermeasures and record keeping, and the security duty moves to Article 20-1.

Key Elements

• Personal data (Article 2)

Names, birth dates, ID and passport numbers, physical characteristics, fingerprints, health and genetic data, financial conditions, contact details and any information that identifies a person directly or indirectly.

• Purpose and legal basis (Articles 5, 19, 20)

Collection for a specific purpose on a listed basis; use inside the necessary scope of that purpose, with listed exceptions for another purpose.

• Notice (Articles 8 and 9)

Six items at collection; for data not obtained from the data subject, the source and the same items before processing or use, or at first use of the data toward the person.

• Requests (Articles 10, 11, 13, 14)

Inquiry, review, copy, correction and deletion, with the response periods in Article 13 and a fee for necessary costs.

• Security and breach (Articles 12, 27, 20-1)

Notice to the data subject now; security measures for personal data files; the amended text adds a report to the competent authority and countermeasures.

• Cross-border transfer (Article 21)

The competent authority may restrict a non-government agency's transfer for major national interests, a treaty, a destination without proper protection rules or a circumvention of the Act.

What does it cover?

The PDPA covers government agencies, defined as central or local government bodies and non-departmental public bodies exercising public authority, and non-government agencies, defined as any natural person, legal person or group outside that definition (Article 2). Article 51 excludes a natural person's purely personal or household activities and audio-visual data from public places that is not linked to other personal data. Article 51, paragraph 2 also applies the Act to government and non-government agencies outside the territory of the Republic of China when they collect, process or use the personal data of its nationals.

What are its objectives?

Article 1 states the aim: to regulate the collection, processing and use of personal data so as to prevent harm to personality rights and to facilitate the proper use of personal data.

Require a specific purpose and legal basis for every collection and use of personal data.

Give data subjects notice and five enforceable rights that cannot be waived in advance under Article 3.

Hold agencies liable through damages, class action by qualifying foundations, fines and criminal penalties.

Set security duties for personal data files, with breach notification and, once in force, reporting.

Allow the competent authority to restrict transfers abroad that threaten national interests or evade the Act.

Framework in Context

Taiwan's Constitutional Court, in Judgment 111-Hsien-Pan-13, called for an independent supervisory mechanism, which led to Article 1-1 and the PDPC Preparatory Office. The November 2025 amendment gives the Commission powers over government agencies first, while businesses that already have an industry regulator stay under it for up to six years after the Commission is established (Article 51-1), with the scope reviewed every two years. Ministries such as Economic Affairs and Transportation and Communications already issue industry rules on personal data file security, and the Enforcement Rules and the list of specific purposes and categories of personal data under Article 53 support the Act.

Common Framework Mappings

Organizations map the PDPA to regional and global privacy frameworks so that one set of purpose records, notices, request handling and security controls serves every market they operate in.

Mapped frameworks include:

APEC CBPR System

PIPL

GDPR

ISO 27701

APPI

NIST Privacy Framework v1.0

Singapore PDPA

PIPA (South Korea)