Compare countries

Two or three countries, side by side, one row per question. Pick up to 3.

Countries

PolandChecked 18 August 2026

Yes, with paperworkWork: HighEnforcement: Active

In one paragraph: Poland is a European Union country, so data may leave as long as you use one of the approved European transfer routes. We found no general Polish rule forcing data to stay in the country. The privacy regulator is fully staffed and busy, and it fines government bodies as well as companies. Finance is the sector to watch: the financial supervisor wants cloud data kept in Europe.
The catch: True in general, much weaker in finance. Banks, insurers, brokers and payment firms follow a supervisory notice telling them to keep cloud data in European data centres, to put critical firms' data inside Poland first where they can, and to warn the financial supervisor 14 days before any cloud project starts. That notice is a strong recommendation, not a ban — but the supervisor checks it. Classified government information sits outside all of this and is effectively locked inside Poland.
Does this apply to me?: Yes, it reaches you with no office in Poland. European privacy law applies to any organisation anywhere that offers goods or services to people in Poland, or that monitors their behaviour. There is no size or revenue threshold. An organisation based outside Europe normally has to name a representative inside Europe. Poland then adds one local step that foreign groups routinely miss: if you must appoint a data protection officer, you have to tell the Polish regulator that person's name and contact details within 14 days of appointing them.High confidence
Can the data leave the country?: Yes, with paperwork. Poland has not added a general rule of its own that keeps data inside the country, and European law actually forbids member states from imposing storage-location rules on data that is not about people, except on public-security grounds. We searched for industry walls in banking, payments, insurance, securities, health, telecoms, government cloud, mapping and gambling. The only one we could confirm from an official Polish source is in finance, and it is a firm supervisory recommendation rather than an outright ban.Medium confidence
What do I have to do to send it abroad?: Think of it as an approved-routes list. Personal data may go outside Europe if the destination country has been officially approved, or if you sign the standard European contract with the recipient, or if your corporate group has rules approved by a regulator. The approved-country list is real and populated — roughly sixteen countries plus one international organisation. For the United States it only covers companies that have signed up to a specific certification scheme, so you have to check the recipient, not the country.High confidence
Who enforces this — and are they actually working?: The Personal Data Protection Office, and it is genuinely working. It is led by Mirosław Wróblewski, it publishes news several times a week, and its public decisions database held 581 decisions when we checked on 18 August 2026, with new ones published through June and July 2026. It fines public bodies too: it penalised the Minister of Justice in June 2026 and a local social welfare centre later the same month. Three other regulators matter — the financial supervisor for banks and insurers, the electronic communications office for telecoms and post, and the Ministry of Digital Affairs for cyber security.High confidence
How long must I keep it, and when must I delete it?: There is a ceiling and a floor. The ceiling is European: you may not keep personal data in a form that identifies someone for longer than you need it, and you have to be able to state that period. The floor is Polish: tax, accounting, employment and medical rules force you to keep certain records for years. When the two collide, the specific keeping duty wins for those records and everything else must still be deleted on time. We could not open the official Polish texts for the exact periods on the day we checked, so treat any specific number you read elsewhere as unverified until you see the statute.Medium confidence
What happens when something goes wrong?: Count at least two clocks, often three. For a personal data breach you have 72 hours to tell the Polish privacy regulator, and you must warn the people affected without undue delay if the risk to them is high. Separately, Poland rewrote its cyber security law and the new version started on 3 April 2026; if you are on the new register of key or important organisations you also report to the national cyber teams, on a much shorter first clock. Financial firms add a third set of reporting duties to the financial supervisor. The overlap is what breaks people, because the same incident triggers all three with different content and different deadlines.Medium confidence
What's the trap?: Five things that are not in the summary. First, appointing a data protection officer is not the end of it — you have 14 days to file that person's name and contact details with the Polish regulator, and foreign groups miss this constantly. Second, the list of Polish organisations that must appoint one is wider than expected and includes the central bank and state research institutes. Third, a brand-new Polish law on data management started in July 2026 and can fine you about two million złoty, roughly $550,000, for sending protected public-sector data to the wrong country. Fourth, the financial supervisor expects to be told 14 days before a cloud project starts and wants critical firms' data inside Poland where possible. Fifth, being a public body is no shield — the regulator fined the Minister of Justice in June 2026.High confidence
What's about to change?: Three dated things and one live risk. Poland's new cyber security register is being phased in through 2026: self-registration opened on 7 May 2026, and organisations the ministry enters itself get six months from being served notice to complete their details. On 12 January 2027 European rules ban cloud providers from charging you anything to move your data out. On 2 April 2027 a new European regulation on how privacy regulators run cross-border cases starts to apply, which will change how Polish complaints against foreign companies are handled. The live risk is the European Union–United States data transfer arrangement, which is valid today but being challenged.High confidence
Hardest industry wall: None found.

TaiwanChecked 18 August 2026

Depends on your industryWork: HighEnforcement: Active

In one paragraph: Taiwan lets personal data leave the country freely unless the ministry that regulates your industry has issued an order stopping it. There is no single privacy regulator: each industry ministry polices its own sector, and each has written its own security and breach-reporting rules. A big reform that would create one national regulator was passed in November 2025 but has never been switched on.
The catch: The relaxed headline stops being true the moment you touch health records, national health insurance data, banking or telecoms. Hospital data held in the cloud must physically sit in Taiwan. National health insurance records cannot be released to any organisation set up outside Taiwan at all. Banks need the financial regulator's permission before major consumer-finance systems go offshore, and must keep a backup of important customer data in Taiwan if they do.
Does this apply to me?: Yes. Taiwan's privacy law reaches a foreign company with no office and no staff in Taiwan. The law says plainly that it also applies to organisations outside Taiwan that collect, process or use the personal data of Taiwanese people. There is no revenue or headcount threshold to fall below, and the law does not require you to appoint a local representative.High confidence
Can the data leave the country?: In general, yes. Taiwan's privacy law does not ask you to sign anything or get anyone's permission before sending personal data abroad. Instead it gives each industry ministry the power to order that data in its sector may not go to a particular country. But four sectors have real walls, and in two of them the wall is absolute.High confidence
What do I have to do to send it abroad?: Under the general law, nothing. No standard contract, no government approval, no adequacy finding, no consent form. The model is a blocklist run sector by sector: you may send data anywhere unless the ministry that supervises your industry has issued an order stopping it. Your real job is to find out which ministry supervises you and check whether it has issued one.High confidence
Who enforces this — and are they actually working?: There is no national privacy regulator in Taiwan today. A Personal Data Protection Commission is named in the law as the authority in charge, but that provision has never been switched on, the law creating the Commission is still only a bill, and what exists is a preparatory office that writes draft rules and cannot fine anyone. Enforcement is done instead by whichever ministry regulates your industry, plus city and county governments, and those bodies are genuinely active.High confidence
How long must I keep it, and when must I delete it?: Both directions apply, and the floors are set by other laws, not the privacy law. Accounting vouchers must be kept at least five years and account books and financial statements at least ten years. Medical records must be kept at least seven years, and for children until seven years after they turn eighteen; records from human trials must be kept forever. Going the other way, you must delete personal data once the purpose you collected it for has gone or the period you set has run out.High confidence
What happens when something goes wrong?: Count at least three clocks, and the fastest is one hour. Telecoms companies and larger internet providers must tell the communications regulator within one hour of learning about a major personal data incident, then file a full report within seventy-two hours. Government bodies and designated critical infrastructure operators also have one hour, under the separate cyber security law. Financial firms get seventy-two hours. And under the privacy law itself you must tell the affected people once you have established the facts, with no fixed deadline attached.High confidence
What's the trap?: Five things that will cost someone their weekend. First, the official English text of the privacy law on the government's own website includes provisions that are not law yet, including the one naming the national regulator. Second, breaking a cross-border transfer order is a crime, not a fine — up to five years in prison. Third, there is no single regulator to ask; your duties depend on which ministry supervises you. Fourth, a bank asked for Taiwanese customer data by a foreign financial regulator must get Taiwan's regulator's permission first. Fifth, if you are sued, you have to prove you were not at fault.High confidence
What's about to change?: One thing has already landed and one is waiting on a switch. The National Health Insurance Data Management Act came into force on 10 August 2026, and it gives people a short window to opt their health records out of research use before silence counts as agreement. Separately, the big privacy reform passed in November 2025 is sitting on the shelf: the Cabinet can bring it into force whenever it likes, by a single order, with no consultation.High confidence
Hardest industry wall: Health and social care — 醫療機構電子病歷製作及管理辦法 (Regulations Governing the Production and Management of Electronic Medical Records by Medical Institutions)
Health and social care — 全民健康保險資料管理條例 (National Health Insurance Data Management Act)
Banking — 金融機構作業委託他人處理內部作業制度及程序辦法 (Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation)

The eight framework questions answered for each selected country
Question	PolandChecked 18 August 2026	TaiwanChecked 18 August 2026
The three ratings	Yes, with paperwork Work: High Enforcement: Active	Depends on your industry Work: High Enforcement: Active
In one paragraph	Poland is a European Union country, so data may leave as long as you use one of the approved European transfer routes. We found no general Polish rule forcing data to stay in the country. The privacy regulator is fully staffed and busy, and it fines government bodies as well as companies. Finance is the sector to watch: the financial supervisor wants cloud data kept in Europe.	Taiwan lets personal data leave the country freely unless the ministry that regulates your industry has issued an order stopping it. There is no single privacy regulator: each industry ministry polices its own sector, and each has written its own security and breach-reporting rules. A big reform that would create one national regulator was passed in November 2025 but has never been switched on.
The catch	True in general, much weaker in finance. Banks, insurers, brokers and payment firms follow a supervisory notice telling them to keep cloud data in European data centres, to put critical firms' data inside Poland first where they can, and to warn the financial supervisor 14 days before any cloud project starts. That notice is a strong recommendation, not a ban — but the supervisor checks it. Classified government information sits outside all of this and is effectively locked inside Poland.	The relaxed headline stops being true the moment you touch health records, national health insurance data, banking or telecoms. Hospital data held in the cloud must physically sit in Taiwan. National health insurance records cannot be released to any organisation set up outside Taiwan at all. Banks need the financial regulator's permission before major consumer-finance systems go offshore, and must keep a backup of important customer data in Taiwan if they do.
Does this apply to me?	Yes, it reaches you with no office in Poland. European privacy law applies to any organisation anywhere that offers goods or services to people in Poland, or that monitors their behaviour. There is no size or revenue threshold. An organisation based outside Europe normally has to name a representative inside Europe. Poland then adds one local step that foreign groups routinely miss: if you must appoint a data protection officer, you have to tell the Polish regulator that person's name and contact details within 14 days of appointing them.High confidence	Yes. Taiwan's privacy law reaches a foreign company with no office and no staff in Taiwan. The law says plainly that it also applies to organisations outside Taiwan that collect, process or use the personal data of Taiwanese people. There is no revenue or headcount threshold to fall below, and the law does not require you to appoint a local representative.High confidence
Can the data leave the country?	Yes, with paperwork. Poland has not added a general rule of its own that keeps data inside the country, and European law actually forbids member states from imposing storage-location rules on data that is not about people, except on public-security grounds. We searched for industry walls in banking, payments, insurance, securities, health, telecoms, government cloud, mapping and gambling. The only one we could confirm from an official Polish source is in finance, and it is a firm supervisory recommendation rather than an outright ban.Medium confidence	In general, yes. Taiwan's privacy law does not ask you to sign anything or get anyone's permission before sending personal data abroad. Instead it gives each industry ministry the power to order that data in its sector may not go to a particular country. But four sectors have real walls, and in two of them the wall is absolute.High confidence
What do I have to do to send it abroad?	Think of it as an approved-routes list. Personal data may go outside Europe if the destination country has been officially approved, or if you sign the standard European contract with the recipient, or if your corporate group has rules approved by a regulator. The approved-country list is real and populated — roughly sixteen countries plus one international organisation. For the United States it only covers companies that have signed up to a specific certification scheme, so you have to check the recipient, not the country.High confidence	Under the general law, nothing. No standard contract, no government approval, no adequacy finding, no consent form. The model is a blocklist run sector by sector: you may send data anywhere unless the ministry that supervises your industry has issued an order stopping it. Your real job is to find out which ministry supervises you and check whether it has issued one.High confidence
Who enforces this — and are they actually working?	The Personal Data Protection Office, and it is genuinely working. It is led by Mirosław Wróblewski, it publishes news several times a week, and its public decisions database held 581 decisions when we checked on 18 August 2026, with new ones published through June and July 2026. It fines public bodies too: it penalised the Minister of Justice in June 2026 and a local social welfare centre later the same month. Three other regulators matter — the financial supervisor for banks and insurers, the electronic communications office for telecoms and post, and the Ministry of Digital Affairs for cyber security.High confidence	There is no national privacy regulator in Taiwan today. A Personal Data Protection Commission is named in the law as the authority in charge, but that provision has never been switched on, the law creating the Commission is still only a bill, and what exists is a preparatory office that writes draft rules and cannot fine anyone. Enforcement is done instead by whichever ministry regulates your industry, plus city and county governments, and those bodies are genuinely active.High confidence
How long must I keep it, and when must I delete it?	There is a ceiling and a floor. The ceiling is European: you may not keep personal data in a form that identifies someone for longer than you need it, and you have to be able to state that period. The floor is Polish: tax, accounting, employment and medical rules force you to keep certain records for years. When the two collide, the specific keeping duty wins for those records and everything else must still be deleted on time. We could not open the official Polish texts for the exact periods on the day we checked, so treat any specific number you read elsewhere as unverified until you see the statute.Medium confidence	Both directions apply, and the floors are set by other laws, not the privacy law. Accounting vouchers must be kept at least five years and account books and financial statements at least ten years. Medical records must be kept at least seven years, and for children until seven years after they turn eighteen; records from human trials must be kept forever. Going the other way, you must delete personal data once the purpose you collected it for has gone or the period you set has run out.High confidence
What happens when something goes wrong?	Count at least two clocks, often three. For a personal data breach you have 72 hours to tell the Polish privacy regulator, and you must warn the people affected without undue delay if the risk to them is high. Separately, Poland rewrote its cyber security law and the new version started on 3 April 2026; if you are on the new register of key or important organisations you also report to the national cyber teams, on a much shorter first clock. Financial firms add a third set of reporting duties to the financial supervisor. The overlap is what breaks people, because the same incident triggers all three with different content and different deadlines.Medium confidence	Count at least three clocks, and the fastest is one hour. Telecoms companies and larger internet providers must tell the communications regulator within one hour of learning about a major personal data incident, then file a full report within seventy-two hours. Government bodies and designated critical infrastructure operators also have one hour, under the separate cyber security law. Financial firms get seventy-two hours. And under the privacy law itself you must tell the affected people once you have established the facts, with no fixed deadline attached.High confidence
What's the trap?	Five things that are not in the summary. First, appointing a data protection officer is not the end of it — you have 14 days to file that person's name and contact details with the Polish regulator, and foreign groups miss this constantly. Second, the list of Polish organisations that must appoint one is wider than expected and includes the central bank and state research institutes. Third, a brand-new Polish law on data management started in July 2026 and can fine you about two million złoty, roughly $550,000, for sending protected public-sector data to the wrong country. Fourth, the financial supervisor expects to be told 14 days before a cloud project starts and wants critical firms' data inside Poland where possible. Fifth, being a public body is no shield — the regulator fined the Minister of Justice in June 2026.High confidence	Five things that will cost someone their weekend. First, the official English text of the privacy law on the government's own website includes provisions that are not law yet, including the one naming the national regulator. Second, breaking a cross-border transfer order is a crime, not a fine — up to five years in prison. Third, there is no single regulator to ask; your duties depend on which ministry supervises you. Fourth, a bank asked for Taiwanese customer data by a foreign financial regulator must get Taiwan's regulator's permission first. Fifth, if you are sued, you have to prove you were not at fault.High confidence
What's about to change?	Three dated things and one live risk. Poland's new cyber security register is being phased in through 2026: self-registration opened on 7 May 2026, and organisations the ministry enters itself get six months from being served notice to complete their details. On 12 January 2027 European rules ban cloud providers from charging you anything to move your data out. On 2 April 2027 a new European regulation on how privacy regulators run cross-border cases starts to apply, which will change how Polish complaints against foreign companies are handled. The live risk is the European Union–United States data transfer arrangement, which is valid today but being challenged.High confidence	One thing has already landed and one is waiting on a switch. The National Health Insurance Data Management Act came into force on 10 August 2026, and it gives people a short window to opt their health records out of research use before silence counts as agreement. Separately, the big privacy reform passed in November 2025 is sitting on the shelf: the Cabinet can bring it into force whenever it likes, by a single order, with no consultation.High confidence
Hardest industry wall	None found.	Health and social care — 醫療機構電子病歷製作及管理辦法 (Regulations Governing the Production and Management of Electronic Medical Records by Medical Institutions) Health and social care — 全民健康保險資料管理條例 (National Health Insurance Data Management Act) Banking — 金融機構作業委託他人處理內部作業制度及程序辦法 (Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation)