🇹🇼Personal Data Protection Act

← Back to laws in Taiwan

A personal data law built around purpose, notice and personality rights

Taiwan's Personal Data Protection Act regulates the collection, processing and use of personal data to prevent harm to personality rights and to facilitate proper use of personal data. Its architecture is not simply consent-based. It is built around specific purpose, good faith, necessary scope, recognised processing grounds, data subject rights, security duties and supervisory control.

The uploaded source reflects a current version amended on 11 November 2025 and identifies the Personal Data Protection Commission as the competent authority. This is important because Taiwan's system now places a central authority at the core of policy coordination, supervision, breach reporting and enforcement.

Key definitions — personal data, processing and use

Article 2 defines personal data broadly. It includes a natural person's name, date of birth, national identification card number, passport number, physical characteristics, fingerprints, marital status, family information, education background, occupation, medical records, healthcare data, genetic data, sex life, physical examination records, criminal records, contact information, financial conditions, social activities, and any other information that may directly or indirectly identify a natural person.

The Act distinguishes between collection, processing and use. Collection means collecting personal data in any way. Processing includes recording, inputting, storing, compiling, editing, correcting, duplicating, retrieving, deleting, outputting, connecting or internally transferring data for establishing or using a personal data file. Use means using personal data by methods other than processing. This distinction matters because different provisions regulate collection, processing and use separately.

A government agency includes central or local government agencies and non-departmental public bodies authorised to exercise public authority. A non-government agency includes a natural person, legal person or group other than a government agency. A commissioned person who collects, processes or uses personal data is deemed to act on behalf of the commissioning agency for PDPA purposes.

The basic processing standard — good faith and necessary scope

Article 5 sets the general standard. Collection, processing and use of personal data must respect the data subject's rights and interests, be conducted honestly and in good faith, not exceed the necessary scope of specific purposes, and have a legitimate and reasonable connection with the purpose of collection.

This is the spine of the PDPA. Even where a statutory basis or consent exists, the processing must still stay within the necessary scope of a specific purpose. Organisations that collect broad categories of data “just in case” or reuse data for loosely related purposes are exposed because the Act asks whether the processing is necessary, specific and reasonably connected.

Purpose is therefore not just a notice field. It is the legal boundary for collection, processing and use.

Sensitive categories under Article 6

Article 6 creates heightened restrictions for data relating to medical records, healthcare, genetics, sex life, physical examination and criminal records. These categories generally may not be collected, processed or used unless one of the Article 6 grounds applies.

Those grounds include express legal requirement, necessity for a government agency's statutory duties or a non-government agency's statutory obligations with proper security and maintenance measures, data manifestly made public by the data subject or publicised legally, public-interest statistics or academic research for healthcare, public health or crime prevention where identification is not possible, necessity to assist a government agency or non-government agency in statutory duties or obligations with proper security and maintenance measures, or written consent of the data subject subject to important limits.

Written consent does not cure everything. The Article 6 consent ground does not apply where the collection, processing or use exceeds the necessary scope of the specific purpose, where processing based solely on consent is otherwise prohibited by law, or where the consent is not freely given. This makes Article 6 a genuine higher-risk rule, not a simple consent exception.

Consent and notice — the collector carries the burden

Article 7 defines consent as a declaration of agreement after the data subject has been informed of the required information. For use beyond the original purpose, consent must be a separate declaration after the data subject is informed of the other purpose, scope of other use, and the impact of giving or not giving consent.

Consent may be presumed in limited circumstances where the data subject does not object and affirmatively provides personal data after being informed of the relevant Article 8 information. The data collector bears the burden of proving that the required consent was obtained.

Article 8 requires government and non-government agencies to expressly inform the data subject, when collecting personal data, of the agency's name, the purpose of collection, categories of data collected, the time period, territory, recipients and methods of use, the data subject's Article 3 rights and methods for exercising them, and the rights and interests affected if the data subject does not provide the data.

Article 9 extends notice to data not obtained from the data subject. Before processing or using such data, the agency must inform the data subject of the source of the data and the relevant Article 8 information, unless an exemption applies.

Data subject rights and response timelines

Article 3 gives data subjects rights that cannot be waived or contractually limited in advance. These include the right to inquire and review personal data, request a copy, supplement or correct data, demand cessation of collection, processing or use, and request erasure.

Article 10 requires agencies to respond to inquiries, allow review or provide copies except where national security, diplomatic or military secrets, overall economic interests or other material national interests may be harmed, where a government agency may be prevented from performing statutory duties, or where the vital interests of data collectors or third parties may be adversely affected.

Article 11 requires agencies to ensure accuracy and correct or supplement data on their own initiative or on request. If accuracy is disputed, processing or use must cease unless necessary for official or business duties, or the data subject has agreed in writing and the dispute is recorded. When the specific purpose no longer exists or the relevant time period has expired, the agency must erase or cease processing or use unless continued processing is necessary or agreed to in writing. Data collected, processed or used in violation of the PDPA must be erased or processing must cease.

Article 13 requires agencies to decide whether to accept or reject an access-type request under Article 10 within 15 days, extendable by up to 15 days with written reasons. Article 14 requires decisions on Article 11 correction-type requests within 30 days, extendable by up to 30 days with written reasons.

Government agency processing

Article 15 provides that, except for Article 6 sensitive categories, government agencies may collect or process personal data only for specific purposes and on one of three bases: the processing is within the necessary scope of statutory duties, consent has been given by the data subject, or the data subject's rights and interests will not be infringed.

Article 16 requires government agencies to use personal data only within the necessary scope of statutory duties and for the specific purpose of collection. Use for another purpose is permitted only on recognised grounds, including express legal requirement, national security or public interest, preventing harm to life, body, freedom or property, preventing material harm to others' rights, public-interest statistics or academic research with non-identification safeguards, the data subject's rights and interests, or consent.

Government agencies must also publish or make available information about personal data files, including file names, agency name and contact information, legal basis and purpose, and data categories. They must appoint a Personal Data Protection Officer and designate personnel to handle security and maintenance of personal data files.

Non-government agency processing

Article 19 governs non-government agency collection and processing of general personal data. It requires a specific purpose and a recognised basis. These include express legal requirement, contractual or quasi-contractual relationship with proper security measures, data manifestly made public by the data subject or legally publicised, public-interest statistics or academic research by an academic institution where identification is not possible, consent, public interest, data obtained from publicly available sources unless the data subject has an overriding interest against processing or use, or where the data subject's rights and interests will not be infringed.

Article 20 governs use by non-government agencies. Personal data must be used only within the necessary scope of the specific purpose of collection. Use for another purpose requires a recognised basis such as law, public interest, prevention of harm to the data subject, prevention of material harm to others, public-interest research with non-identification safeguards, consent, or the data subject's rights and interests.

Marketing has a direct opt-out rule. When a non-government agency uses personal data for marketing, it must stop using the data for marketing if the data subject objects. On first marketing use, it must provide a way for the data subject to object and bear the fees resulting from the objection mechanism.

Security, breach notification and reporting

Article 20-1 requires non-government agencies possessing personal data files to implement security and maintenance measures to prevent theft, alteration, damage, loss or leakage. Detailed regulations on security and maintenance, management mechanisms and related measures are to be prescribed by the competent authority.

Article 12 requires government and non-government agencies to notify the data subject when they become aware that personal data they hold has been stolen, altered, damaged, lost or leaked. Where the incident falls within the specified reporting scope, government agencies must report to the competent authority and designated implementation-report authorities, while non-government agencies must report to the competent authority, which then informs the relevant industry authority.

The agency must also take immediate and effective countermeasures to prevent escalation, document the facts, impacts and response measures, and preserve relevant records for inspection. The competent authority will prescribe rules on notification and reporting content, method, timing, scope, countermeasures and record retention.

Cross-border transfers

Article 21 allows the competent authority to restrict cross-border transfers of personal data by non-government agencies in specified circumstances. These include where major national interests are involved, where an international treaty or agreement so requires, where the recipient country lacks proper personal data protection regulations and the data subject's rights and interests may be harmed, or where transfer to a third country or territory is used to circumvent the PDPA.

Taiwan's PDPA therefore does not use a full adequacy-and-SCC structure in the same way as the GDPR. Instead, the competent authority has targeted restriction powers. Organisations should still conduct transfer risk checks because a transfer can be restricted where the recipient jurisdiction lacks proper protection and harm may result.

Administrative supervision

The uploaded version includes detailed supervisory provisions. Government agencies must submit annual reports on their management and protection of personal data to their superior or supervisory agencies or to designated authorities. Supervisory agencies must audit subordinate or supervised agencies and submit rectification reports when deficiencies are identified.

The competent authority may conduct periodic or ad hoc audits of government agencies. Where a government agency is likely to violate the PDPA, the competent authority may request information and explanations or conduct on-site inspections. Where a violation is found, it may order rectification within a specified period and publicise the agency's name and violation facts if rectification is not completed.

For non-government agencies, the competent authority may request opinions, documents, data or items, and may conduct inspections independently or jointly with industry and local authorities. It may seize or copy personal data or files that may be confiscated or used as evidence. Non-government agencies and relevant personnel must not evade, obstruct or refuse inspections without legitimate grounds.

Damages, class actions and penalties

Government agencies are liable for damages caused by unlawful collection, processing or use of personal data or other rights infringements due to PDPA violations, unless the injury was caused by force majeure. Non-government agencies are liable for such damages unless they prove the injury was not caused by wilful act or negligence.

Where actual damage is difficult or impossible to prove, a court may award compensation between NT$500 and NT$20,000 per incident per person depending on severity. For multiple data subjects affected by the same incident, total compensation is capped at NT$200 million unless the interests involved exceed that amount.

Criminal penalties apply to serious misconduct. A person who, with intent to obtain unlawful benefit or harm another, violates specified processing provisions or cross-border restriction orders and causes harm may face imprisonment of up to five years and a fine of up to NT$1,000,000. Similar penalties apply to illegal alteration or erasure of personal data files that compromises accuracy and causes damage.

Administrative fines for non-government agencies vary by violation. Serious security and maintenance failures can lead to fines from NT$20,000 to NT$2,000,000, and if not rectified, successive fines from NT$150,000 to NT$15,000,000. Material violations can trigger the higher range immediately. Representatives, managers or authorised representatives may be fined the same amount unless they prove due care.