Taiwan’s Personal Data Protection Act

Taiwan’s Personal Data Protection Act (PDPA) took effect on May 26, 2010. Major amendments to the PDPA were made in 2015 and 2023.

The PDPA applies to both government agencies and non-government organizations handling personal data.

Data subjects in Taiwan have the right to seek compensation through civil actions for damages caused by breaches of the PDPA's provisions. 

Breach of Articles 6(1), 19, 20(1), or international transmission, may lead to a fine of NTD 50,000 to 500,000  and a rectification order within a limitation period. Moreover, a breach of Articles 8, 9, 10, 11, 12, 13, 20(2), 20(3) may lead to a fine of NTD 20,000 to 200,000  and a rectification order within a limitation period. Non-compliance with Article 27(1) (security and maintenance plan failures) may lead to a fine of NTD 20,000 to 2,000,000 or NTD 150,000 to 15,000,000 in case of a serious violation. There are additional fines for each occurrence if not rectified.

The PDPA also provides criminal penalties. Breach of Articles 6(1), 15, 16, 19, 20(1), or international transmission limits with intent to gain illegal interest or harm others may lead to imprisonment of up to 5 years and/or fines up to 1,000,000.  Additionally, alteration, deletion, or hindrance of personal data with intent to gain illegal interest or cause harm may lead to imprisonment of up to 5 years or short-term imprisonment and/or a fine of up to NTD 1,000,000.

Cross-border data transfers are generally permitted but may be restricted by central competent authorities under specific circumstances, such as inadequate protection in the destination country.

Under the PDPA, the appointment of a DPO is not mandatory. Organizations are free to choose whether to appoint one.