Taiwan

The reach comes from the Personal Data Protection Act (個人資料保護法), Article 51, paragraph 2, in the version now in force: 公務機關及非公務機關，在中華民國領域外對中華民國人民個人資料蒐集、處理或利用者，亦適用本法. The official English version says the Act also applies to government and non-government agencies outside the territory of the Republic of China (R.O.C). It covers them when they collect, use or store the personal data of R.O.C. nationals. Criminal liability travels too. Article 43 applies the Act's two criminal offences to Taiwanese nationals who commit them outside Taiwan against other Taiwanese nationals. What the law says and what a regulator can do to you are different questions. Enforcement is carried out by whichever ministry supervises your industry. A company with no Taiwanese entity is harder for them to reach.

The general rule is Article 21 of the Personal Data Protection Act, in force since 2012. The central authority for your industry may block a transfer abroad in four cases. Where major national interests are involved. Where a treaty says so. Where the destination country lacks proper data protection law, so people could be harmed. Or where the transfer routes through a third country to dodge the Act. This is not a general ban. It is not a permission system, and it is not a paperwork exercise. Industry by industry. HEALTH (data must stay in the country). Where a hospital or clinic uses cloud services for electronic medical records, the storage location must be inside Taiwan. The Ministry of Health and Welfare can approve an exception. NATIONAL HEALTH INSURANCE DATA (data must stay in the country). The National Health Insurance Data Management Act started on 10 August 2026. Only bodies set up inside Taiwan may apply to reuse this data. Those are government bodies, public juridical persons, medical institutions, academic research institutions and universities. The data must be worked on in a secure environment, at a place the authority designates. A foreign university or company cannot get it at all. BANKING AND CONSUMER FINANCE (a copy must stay in the country). Customer data for materially significant consumer-finance information systems should normally be stored in Taiwan. If it is stored abroad, important customer data must be backed up and kept in Taiwan. The Financial Supervisory Commission can approve otherwise. The other country's data protection law must not be weaker than Taiwan's. TELECOMS (data can leave only if conditions are met). The National Communications Commission's binding rules apply to communications enterprises. Before every transfer abroad, you must check whether the Commission has restricted it, and follow that. INSURANCE, SECURITIES, EDUCATION, GAMING, MAPPING AND DEFENCE. We found no rule on a government source about data having to stay in Taiwan. Checked 18 August 2026, confidence medium.

This setup is unusual, so here it is precisely. Taiwan has no equivalent of European standard contractual clauses. It has no company-wide binding rules system, and no national list of approved destinations. Article 21 of the Personal Data Protection Act is a power to restrict. It is not a duty to obtain anything. Have any restriction orders been issued? We can confirm the power is live. We could not open the text of any individual order on a government website. Two regulators tell the firms they supervise to check for such restrictions before transferring. That only makes sense if orders exist. The Financial Supervisory Commission requires firms to '進行個人資料國際傳輸前，檢視是否受本會限制並遵循之'. The National Communications Commission requires them to '進行個人資料國際傳輸前，檢視是否受本會相關法令限制並遵循之'. Assume restrictions exist in telecoms and finance, and check with the regulator directly. Breaking such an order is a crime, not just a fine. It carries up to five years in prison. There is also a fine of NT$50,000 to NT$500,000 (roughly $1,600 to $16,000), repeated until you fix the problem. When the November 2025 amendment starts, this power moves from the industry ministries to the new national commission.

Three separate facts, each verified on a government site. First, Article 1-1 of the Personal Data Protection Act says the competent authority is the Personal Data Protection Commission. That article was added on 31 May 2023, and the Executive Yuan was left to set its start date. The official law database records the Act's status as 本法規部分或全部條文尚未生效，最後生效日期：未定. That means some or all of it is not yet in effect, with no date set. Second, the preparatory office published a press release on 17 October 2025. It said the Commission can only be set up formally once the organic act passes. The draft had cleared preliminary committee review only. It also said the Executive Yuan will set the start date of the amended Act separately. Third, the only rules in the national law database carrying the Commission's name are the preparatory office's temporary organisation rules of 23 September 2023. On 1 January 2024 the preparatory office took over two narrow rule-making jobs from the National Development Council. Those are publishing the table of specific purposes and data categories, and the Act's enforcement rules. Nothing more. Four bodies do the real work. They are the Financial Supervisory Commission, the National Communications Commission, the Ministry of Health and Welfare and the Ministry of Digital Affairs. Each supervises, inspects and fines within its own industry. They do this under Articles 22 to 25 and 47 to 50. The National Communications Commission has a standing scoring system for setting fines on communications enterprises that breach the Act. Its own binding rules refer to it. That shows fining is routine, not theoretical. So enforcement is active in the industries and dormant nationally.

The maximum is Article 11, paragraph 3 of the Personal Data Protection Act. When the specific purpose of collection no longer exists, or the relevant time period expires, you must erase the data. You can stop using and storing it instead. You must do this on your own initiative, or when the person asks. The same paragraph settles the clash with the minimum keep times. The duty does not apply where keeping the data is necessary to perform an official or business duty. It also does not apply where the person has agreed in writing. So a keeping duty set by law beats the deletion duty. People also have a separate right to demand erasure under Article 3. They can also demand that you stop collecting, using or storing their data. One firm deletion rule is now live. Article 25 of the National Health Insurance Data Management Act covers health insurance data obtained for secondary use before the Act started on 10 August 2026. That data must be destroyed. The exception is a government body holding it to perform duties set by law. If you fail to destroy it, the fine is NT$2 million to NT$10 million (roughly $64,000 to $320,000).

DEADLINE 1: National Communications Commission rules, Article 4. You must report a major personal data incident to the Commission within one hour of becoming aware of it. A follow-up report on the prescribed form is due within seventy-two hours. If the Commission or another agency told you about the incident first, the form is due within forty-eight hours. This covers telecommunications enterprises, providers of internet access with three thousand or more subscribers, and other communications enterprises the Commission names. DEADLINE 2: Regulations on the Notification and Response of Cyber Security Incidents, amended 5 January 2026, Articles 6 and 11. Government agencies and designated non-government agencies must report to the platform the authority specifies. The deadline is one hour from becoming aware. Damage control or recovery must be completed within seventy-two hours for level one and two incidents. DEADLINE 3: Financial Supervisory Commission rules, Article 6. You must report a major personal data incident to the Commission within seventy-two hours, on the prescribed form. DEADLINE 4: Personal Data Protection Act, Article 12, as currently in force. You must tell the people affected in a suitable way after you have established the facts. There is no hour count. The Act itself does not make you tell a regulator at all. That changes when the November 2025 amendment starts. It adds a single reporting duty to the new national commission. The deadline will be set in a regulation that has not been made yet.

(1) The Ministry of Justice law database publishes the amended text. The English translation shows Article 1-1 naming the Personal Data Protection Commission as competent authority. The database's own status line says some or all of the Act has not taken effect, with no date set. Read the English page at face value and you will get four things wrong. The regulator, the breach-reporting duty, the data protection officer duty and the fine levels. (2) Article 41 of the Act as in force. It makes one thing a crime: breaching an industry authority's order restricting transmission abroad. Two conditions apply. You must act with intent to gain an unlawful benefit or harm another's interest. And you must cause harm. The punishment is up to five years' imprisonment, plus a fine of up to NT$1 million (about $32,000). Under Article 45 that offence is prosecuted without a complaint from the victim. Article 44 increases the sentence by up to half for public officials. (3) Compliance is split up. Each central industry authority issues its own personal data file security maintenance rules under Article 27. Each sets its own security plan requirements and its own breach deadline. It is one hour in telecoms and seventy-two hours in finance. (4) Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation, Article 17, subparagraph 5. Your outsourced provider may sit in another country. If that country's financial regulator asks for Taiwanese customer information, you must first tell Taiwan's Financial Supervisory Commission. You must get its consent before handing anything over. (5) Article 29. A private organisation is liable for damage unless it can prove the harm was not caused by its intent or negligence. Courts may award NT$500 to NT$20,000 per person per incident, with no proof of actual loss. Total awards for one incident are capped at NT$200 million, roughly $6.4 million. Registered foundations and public-interest associations can bring group claims.

STARTING NOW. The National Health Insurance Data Management Act was promulgated on 19 December 2025. The Cabinet set it to start on 10 August 2026, by an order dated 6 August 2026. Article 16 makes the authority stop accepting new secondary-use applications for thirty days from the start date. A person who does not ask for their data to be stopped within that window is treated as having agreed. So the window closes around 9 September 2026. You can still opt out later, but it only works going forward. Health insurance data already released for secondary use before 10 August 2026 must be destroyed. The exception is a government body holding it for duties set by law. WAITING TO BE SWITCHED ON, in order of importance. One: the Executive Yuan can set the start date of the November 2025 privacy amendment at any time, by order. That single order would create a national regulator. It could receive breach reports, set one common baseline security rule, restrict transfers abroad, and audit and inspect both government and private bodies. Two: the organic act creating the Personal Data Protection Commission is still only a bill. It had cleared preliminary committee review by October 2025. The regulator's own website has published nothing since 9 March 2026. Three: any central industry authority can restrict cross-border transfers by order under Article 21, at any time. There is no consultation and no appeal to a national regulator. Four: when the Commission is finally established, a six-year transition begins. During it, existing industry regulators keep supervising the businesses they already supervise. The list is cut back every two years. Also waiting: six draft regulations were announced between January and March 2026. They cover five things. The enforcement rules. The data protection officer competency rules. Audit rules for government bodies. Inspection rules for private bodies. And the list of businesses that stay with their industry regulator.