Taiwan. Comprehensive data protection. Act
PDPA (Taiwan)Personal Data Protection Act (個人資料保護法)
Partly verified
Medium confidence.2023 amendment details from general knowledge (not in sources read). PDPC still a preparatory office as of March 2026 per DLA Piper.
§1Summary
- Synopsis
Taiwan's general data protection statute covering government and non-government agencies. It requires notice at collection, purpose-bound processing, security measures and breach notification to individuals, enforced currently by sector regulators.
- Key themes
- Unique features
Statutory damages per person and capped class-action awards; regulators can restrict transfers to specific countries (several bans on transfers to mainland China).
- SaaS relevance
Applies to non-government agencies processing personal data in Taiwan; some sectors face transfer bans to the PRC.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Notify affected individuals; PDPC reporting to come with 2025 amendment
- DPO
- No
- Cross-border transfers
- Generally free unless restricted by competent authority
- Maximum penalty
- Administrative NT$20k–15m per violation, repeatable; criminal up to 5 years / NT$1m
§3Dates
- Key dates
- Adopted
- In force
- Amended 2015; 2023 amendment created the PDPC legal basis and raised fines for security failures; 2025 amendment promulgated 2025-11-11, not yet in force
§4Text and authority
- Text
- Authoritative text law.moj.gov.tw
- English text law.moj.gov.tw
- Authority
- Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer
§5Where it applies
- Domestic law of
- Taiwan
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.2023 amendment details from general knowledge (not in sources read). PDPC still a preparatory office as of March 2026 per DLA Piper.