Taiwan

Personal Data Protection Act (個人資料保護法), Article 51, paragraph 2, in the version currently in force: 公務機關及非公務機關，在中華民國領域外對中華民國人民個人資料蒐集、處理或利用者，亦適用本法. The official English rendering is: 'The PDPA also applies to the government and the non-government agencies outside the territory of the Republic of China (R.O.C) when they collect, process or use the personal data of R.O.C. nationals.' Criminal liability also travels: Article 43 applies the Act's two criminal offences to Taiwanese nationals who commit them outside Taiwan against other Taiwanese nationals. Practical reach is a separate question from legal reach — enforcement is carried out by whichever ministry supervises your industry, and a company with no Taiwanese entity is harder for them to reach.

The general rule is Article 21 of the Personal Data Protection Act, in force since 2012: the central authority for your industry may restrict an international transfer where major national interests are involved, where a treaty says so, where the destination country lacks proper data protection law so that people could be harmed, or where the transfer routes through a third country to dodge the Act. Note what this is not: it is not a general ban, not a permission regime, and not a paperwork requirement. Sector overrides, each with its own rating: HEALTH (data must stay in the country) — where a hospital or clinic uses cloud services for electronic medical records, the storage location must be inside Taiwan unless the Ministry of Health and Welfare approves an exception. NATIONAL HEALTH INSURANCE DATA (data must stay in the country) — under the National Health Insurance Data Management Act, which commenced on 10 August 2026, only government bodies, public juridical persons, and medical institutions, academic research institutions and universities established inside Taiwan may apply for secondary use, and the data must be worked on in a secure environment at a place the authority designates. A foreign university or company simply cannot get it. BANKING AND CONSUMER FINANCE (a copy must stay in the country) — customer data for materially significant consumer-finance information systems should in principle be stored in Taiwan; if it is stored offshore, important customer data must be backed up and kept in Taiwan unless the Financial Supervisory Commission approves otherwise, and the offshore country's data protection law must not be weaker than Taiwan's. TELECOMS (data can leave with the right paperwork) — the National Communications Commission's binding rules require communications enterprises to check, before every international transfer, whether the Commission has restricted it, and to comply. INSURANCE, SECURITIES, EDUCATION, GAMING, MAPPING AND DEFENCE — no localisation rule found on a government source, checked 18 August 2026, confidence medium.

This is unusual and worth stating precisely. Taiwan has no equivalent of European standard contractual clauses, no binding corporate rules regime and no national list of approved destinations. Article 21 of the Personal Data Protection Act is a power to restrict, not a duty to obtain anything. Is the list populated? We can confirm the mechanism is live but could not open the text of any individual restriction order on a government website. Two regulators' own binding regulations tell the firms they supervise to check for such restrictions before transferring, which only makes sense if orders exist: the Financial Supervisory Commission requires firms to '進行個人資料國際傳輸前，檢視是否受本會限制並遵循之' and the National Communications Commission requires them to '進行個人資料國際傳輸前，檢視是否受本會相關法令限制並遵循之'. Treat the list as populated in telecoms and finance and verify with the regulator directly. Breaching such an order is not merely a fine — it is a criminal offence carrying up to five years in prison, and an administrative fine of NT$50,000 to NT$500,000 (roughly $1,600 to $16,000) with repeat fines until you fix it. When the November 2025 amendment finally commences, this power transfers from the industry ministries to the new national commission.

Three separate facts, each verified on a government site. First, Article 1-1 of the Personal Data Protection Act says the competent authority is the Personal Data Protection Commission. That article was added on 31 May 2023 with its commencement left to the Executive Yuan, and the official law database records the Act's status as 本法規部分或全部條文尚未生效，最後生效日期：未定 — some or all provisions are not yet effective, latest effective date undetermined. Second, the preparatory office's own press release of 17 October 2025 states that formal establishment of the Commission still requires the organic act to pass, that the draft had only cleared preliminary committee review, and that the Executive Yuan will designate the commencement date of the amended Act separately. Third, the only instruments in the national law database bearing the Commission's name are the preparatory office's provisional organisation rules of 23 September 2023. The preparatory office took over two narrow rule-making functions from the National Development Council on 1 January 2024 — publishing the table of specific purposes and data categories, and the Act's enforcement rules — and nothing more. Meanwhile the Financial Supervisory Commission, the National Communications Commission, the Ministry of Health and Welfare and the Ministry of Digital Affairs all supervise, inspect and fine within their sectors under Articles 22 to 25 and 47 to 50. The National Communications Commission has a standing scoring framework for setting fines on communications enterprises that breach the Act, referred to inside its own binding regulation — evidence that fining is routine rather than theoretical. The rating is therefore active in the sectors, dormant nationally.

The ceiling is Article 11, paragraph 3 of the Personal Data Protection Act: when the specific purpose of collection no longer exists or the relevant time period expires, you must erase the data or stop processing and using it, either on your own initiative or when the person asks. The same paragraph resolves the conflict with the floors: the duty does not apply where keeping the data is necessary for performing an official or business duty, or where the person has agreed in writing. In practice a statutory keeping duty beats the deletion duty. People also have a standalone right to demand erasure under Article 3, and a right to demand you stop collecting, processing or using their data. One hard deletion mandate is now live: under Article 25 of the National Health Insurance Data Management Act, health insurance data obtained for secondary use before the Act commenced on 10 August 2026 must be destroyed, except where a government body holds it to perform statutory duties, and failing to destroy it attracts a fine of NT$2 million to NT$10 million (roughly $64,000 to $320,000).

Clock one — National Communications Commission regulation, Article 4: a major personal data incident must be reported to the Commission within one hour of becoming aware, with a follow-up report on the prescribed form within seventy-two hours; if the Commission or another agency told you about the incident first, the form is due within forty-eight hours. This covers telecommunications enterprises, providers of internet access with three thousand or more subscribers, and other communications enterprises the Commission names. Clock two — Regulations on the Notification and Response of Cyber Security Incidents, amended 5 January 2026, Articles 6 and 11: government agencies and designated non-government agencies must report to the platform the authority specifies within one hour of becoming aware. Damage control or recovery must be completed within seventy-two hours for level one and two incidents. Clock three — Financial Supervisory Commission regulation, Article 6: a major personal data incident must be reported to the Commission within seventy-two hours on the prescribed form. Clock four — Personal Data Protection Act, Article 12 as currently in force: you must notify the affected people in an appropriate way after ascertaining the facts. There is no hour count, and there is no duty to tell a regulator at all under the statute itself. That changes when the November 2025 amendment commences: a unified reporting duty to the new national commission is added, with the deadline to be set in a regulation that has not been made.

(1) The Ministry of Justice law database publishes the amended text, and the English translation shows Article 1-1 naming the Personal Data Protection Commission as competent authority. The database's own status line records that some or all provisions have not taken effect and the effective date is undetermined. A naive read of the English page will get the regulator, the breach-reporting duty, the data protection officer duty and the fine levels wrong. (2) Article 41 of the Act as in force: acting with intent to gain an unlawful benefit or harm another's interest, and breaching an industry authority's order restricting international transmission, so as to cause harm, is punishable by up to five years' imprisonment plus a fine up to NT$1 million (about $32,000). Under Article 45 that offence is prosecuted without needing a complaint from the victim, and Article 44 increases the sentence by up to half for public officials. (3) Compliance is fragmented: each central industry authority issues its own personal data file security maintenance regulation under Article 27, and each sets its own security plan requirements and its own breach clock — one hour in telecoms, seventy-two hours in finance. (4) Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation, Article 17, subparagraph 5: where the financial regulator of the country hosting your outsourced provider asks for Taiwanese customer information, the financial institution must first notify Taiwan's Financial Supervisory Commission and obtain its consent before handing anything over. (5) Article 29: a non-government agency is liable for damage unless it can prove the harm was not caused by its intent or negligence. Courts may award NT$500 to NT$20,000 per person per incident without proof of actual loss, and total awards for one incident are capped at NT$200 million, roughly $6.4 million. Registered foundations and public-interest associations can bring group claims.

Landing now. The National Health Insurance Data Management Act was promulgated on 19 December 2025 and the Cabinet set it to start on 10 August 2026 by an order dated 6 August 2026. Article 16 requires the authority to stop accepting new secondary-use applications for thirty days from commencement, and provides that a person who does not ask for their data to be stopped within that window is treated as having agreed — so the window closes around 9 September 2026. Opting out later is still allowed but only works going forward. Health insurance data already released for secondary use before 10 August 2026 must be destroyed, unless a government body holds it for statutory duties. Dormant switches, in order of importance. One: the Executive Yuan can set the commencement date of the November 2025 privacy amendment at any time by order. That single order would create a national regulator with power to receive breach reports, set a common baseline security regulation, restrict international transfers, and audit and inspect both government and private bodies. Two: the organic act creating the Personal Data Protection Commission is still only a bill. It had cleared preliminary committee review by October 2025, and the regulator's own website has published nothing since 9 March 2026. Three: any central industry authority can restrict cross-border transfers by order under Article 21 at any time, with no consultation and no appeal to a national regulator. Four: when the Commission is finally established, a six-year transition begins during which existing industry regulators keep supervising the businesses they already supervise, with the list cut back every two years. Also on the shelf: six draft regulations pre-announced between January and March 2026, covering the enforcement rules, the data protection officer competency rules, audit rules for government bodies, inspection rules for private bodies, and the list of businesses that stay with their industry regulator.