Taiwan. Comprehensive data protection. Act (amendment)
PDPA Amendment 2025Personal Data Protection Act Amendment (2025)
Partly verified
Medium confidence.No confirmed effective date as of the latest source read (March 2026); check Executive Yuan order. [Link: official consolidated PDPA incl. 2025 amendment (promulgated 2025-11-11); official English on MOJ database]
§1Summary
- Synopsis
Establishes the PDPC as an independent single regulator and moves security rule-making, inspections and transfer restrictions to it. Adds mandatory reporting of qualifying breaches to the PDPC and incident record-keeping, with DPO duties limited to government agencies.
- Key themes
- Unique features
Up to six-year transition before non-government agencies move fully from sector regulators to the PDPC.
- SaaS relevance
Once in force, SaaS controllers in Taiwan must report qualifying breaches to the PDPC and meet PDPC security rules.
§2Obligations
- Breach notification
- Individuals plus PDPC for incidents meeting criteria set by regulation
- DPO
- No
- Maximum penalty
- Security failures NT$20k–2m, then NT$150k–15m per uncorrected failure; reporting failures NT$20k–200k
§3Dates
- Key dates
- Adopted
- Passed Legislative Yuan 2025-10-17; promulgated 2025-11-11; effective date to be set by Executive Yuan (expected 2026)
§4Text and authority
- Text
- Authoritative text law.moj.gov.tw
- English text law.moj.gov.tw
- Authority
- Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer
§5Where it applies
- Domestic law of
- Taiwan
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.No confirmed effective date as of the latest source read (March 2026); check Executive Yuan order. [Link: official consolidated PDPA incl. 2025 amendment (promulgated 2025-11-11); official English on MOJ database]