🇹🇼Taiwan

Taiwan's privacy framework is built around personality rights and specific-purpose processing

Taiwan's data protection regime is anchored by the Personal Data Protection Act, commonly referred to as the PDPA. The Act regulates the collection, processing and use of personal data to prevent harm to personality rights and to facilitate the proper use of personal data. Its structure is practical: define a specific purpose, tell the data subject what is happening, stay within the necessary scope of that purpose, protect the data, and give the data subject enforceable rights.

The PDPA applies to both government agencies and non-government agencies. It distinguishes between general personal data and more sensitive categories such as medical records, healthcare data, genetic data, sex life, physical examination records and criminal records. It also creates direct civil liability, administrative penalties and criminal exposure for serious unlawful processing.

The three ideas to understand first

Specific purpose is the legal centre of the PDPA. Collection, processing and use must not exceed the necessary scope of specific purposes and must have a legitimate and reasonable connection with the purpose of collection. Both government and non-government agencies have separate rules for collecting or processing data and for using it beyond the original purpose.

Transparency and data subject rights are built into collection. Data subjects have non-waivable rights to inquire, review, obtain copies, supplement or correct data, demand cessation of collection, processing or use, and request erasure. Agencies must inform data subjects of the collector's identity, collection purpose, categories of data, period, territory, recipients, method of use, rights and consequences of not providing data.

Supervision is now more centralised. The uploaded version identifies the Personal Data Protection Commission as the competent authority. It has supervisory powers over government and non-government agencies, including audit, inspection, breach reporting oversight, rectification orders, publication of violations, and administrative penalties.

How the PDPA works in practice

For non-government agencies, personal data other than Article 6 sensitive categories may be collected or processed only for a specific purpose and on recognised grounds such as law, contractual or quasi-contractual relationship with proper security measures, manifestly public data, public-interest statistics or academic research, consent, public interest, publicly available sources subject to overriding interests, or where the data subject's rights and interests will not be infringed.

Use of personal data is more restricted. Non-government agencies must generally use personal data only within the necessary scope of the specific purpose of collection. Use for another purpose requires a separate basis, such as law, public interest, prevention of harm, protection of others' rights, public-interest research, consent, or the data subject's own rights and interests.

The PDPA also has a distinct marketing rule. When a non-government agency uses personal data for marketing, it must stop if the data subject objects. On first marketing use, the agency must provide the data subject with a way to object and must bear the resulting fees.

What organisations should prioritise

Start with purpose mapping. For every personal data file, identify the specific purpose, legal basis, categories of data, source, retention period, recipients, territory of use, and whether the data is general personal data or Article 6 sensitive data. Taiwan's PDPA is not forgiving of vague purpose statements that do not control actual use.

Then check notice and consent records. Consent must follow disclosure of the required information, and the data collector bears the burden of proving that consent was obtained. Where data is not collected directly from the data subject, the agency may need to inform the data subject of the source and required notice items unless an exemption applies.

Finally, test security, breach and rights workflows. Agencies must maintain security and maintenance measures, respond to access requests within 15 days and correction-type requests within 30 days, notify data subjects of theft, alteration, damage, loss or leakage, and in specified cases report to the competent authority. Non-government agencies face significant administrative fines for security failures and repeated non-compliance.