Privacy Map

Asia. National jurisdiction.

Taiwan TW

Primary authority: Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer
Part I

Domestic law

Comprehensive data protection2

  • PDPA (Taiwan)Personal Data Protection Act (個人資料保護法)In force
    In force from     Taiwan's general data protection statute covering government and non-government agencies. It requires notice at collection, purpose-bound processing, security measures and breach notification to individuals, enforced currently by sector regulators.
    Synopsis

    Taiwan's general data protection statute covering government and non-government agencies. It requires notice at collection, purpose-bound processing, security measures and breach notification to individuals, enforced currently by sector regulators.

    Key themes
    • notice at collection
    • specific purposes
    • sensitive data
    • security plans
    • breach notice to individuals
    • class actions
    Unique features

    Statutory damages per person and capped class-action awards; regulators can restrict transfers to specific countries (several bans on transfers to mainland China).

    SaaS relevance

    Applies to non-government agencies processing personal data in Taiwan; some sectors face transfer bans to the PRC.

    Extraterritorial
    Limited
    Breach notification
    Notify affected individuals; PDPC reporting to come with 2025 amendment
    DPO
    No
    Cross-border transfers
    Generally free unless restricted by competent authority
    Maximum penalty
    Administrative NT$20k–15m per violation, repeatable; criminal up to 5 years / NT$1m
    Key dates
    • Adopted
    • In force
    • Amended 2015; 2023 amendment created the PDPC legal basis and raised fines for security failures; 2025 amendment promulgated 2025-11-11, not yet in force
    Text
    Authority
    Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. 2023 amendment details from general knowledge (not in sources read). PDPC still a preparatory office as of March 2026 per DLA Piper.

    Full record for PDPA (Taiwan)
    Partly verifiedMedium confidence. 2023 amendment details from general knowledge (not in sources read). PDPC still a preparatory office as of March 2026 per DLA Piper.
  • PDPA Amendment 2025Personal Data Protection Act Amendment (2025)Enacted – not yet in force
    Establishes the PDPC as an independent single regulator and moves security rule-making, inspections and transfer restrictions to it. Adds mandatory reporting of qualifying breaches to the PDPC and incident record-keeping, with DPO duties limited to government agencies.
    Synopsis

    Establishes the PDPC as an independent single regulator and moves security rule-making, inspections and transfer restrictions to it. Adds mandatory reporting of qualifying breaches to the PDPC and incident record-keeping, with DPO duties limited to government agencies.

    Key themes
    • independent regulator
    • breach reporting to PDPC
    • security rules
    • inspections
    • transfer restrictions
    • government DPOs
    Unique features

    Up to six-year transition before non-government agencies move fully from sector regulators to the PDPC.

    SaaS relevance

    Once in force, SaaS controllers in Taiwan must report qualifying breaches to the PDPC and meet PDPC security rules.

    Breach notification
    Individuals plus PDPC for incidents meeting criteria set by regulation
    DPO
    No
    Maximum penalty
    Security failures NT$20k–2m, then NT$150k–15m per uncorrected failure; reporting failures NT$20k–200k
    Key dates
    • Adopted
    • Passed Legislative Yuan 2025-10-17; promulgated 2025-11-11; effective date to be set by Executive Yuan (expected 2026)
    Text
    Authority
    Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. No confirmed effective date as of the latest source read (March 2026); check Executive Yuan order. [Link: official consolidated PDPA incl. 2025 amendment (promulgated 2025-11-11); official English on MOJ database]

    Full record for PDPA Amendment 2025
    Partly verifiedMedium confidence. No confirmed effective date as of the latest source read (March 2026); check Executive Yuan order. [Link: official consolidated PDPA incl. 2025 amendment (promulgated 2025-11-11); official English on MOJ database]
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 3 instruments from 2 bodies.

Global Cross-Border Privacy Rules Forum

  • Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force
    In force from     An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
    Synopsis

    An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.

    Key themes
    • certification
    • interoperability
    • accountability agents
    • processors
    • data flows
    Unique features

    The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.

    SaaS relevance

    A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
    Text
    Authority
    Global CBPR Forum; Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.

    Full record for Global CBPR / Global PRP
    Partly verifiedMedium confidence. The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.

Asia-Pacific Economic Cooperation (APEC)

  • APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force
    In force from     Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
    Synopsis

    Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

    Key themes
    • certification
    • accountability agents
    • cross-border enforcement
    • processors
    Unique features

    It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

    SaaS relevance

    PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
    Text
    Authority
    Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.

    Full record for APEC CBPR / PRP
    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
  • APEC Privacy FrameworkAPEC Privacy FrameworkIn force
    In force from     A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
    Synopsis

    A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

    Key themes
    • preventing harm
    • notice
    • choice
    • accountability
    • cross-border privacy enforcement
    • interoperability
    Unique features

    Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

    SaaS relevance

    It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Accountability-based; CBPR system
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
    Text
    Authority
    APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

    Full record for APEC Privacy Framework
    Partly verifiedMedium confidence. I did not re-check the publication URL this session.