Meet the Taiwan PDPA with mapped controls and evidence

The Taiwan PDPA is the Personal Data Protection Act, Taiwan's general data protection law, in force in its current form since 1 October 2012. It governs how government and non-government agencies collect, process and use personal data, requiring a specific purpose and lawful basis, notice to individuals, respect for access, correction and deletion rights, security measures for personal data files and notification of individuals after a data breach.

Government agencies and non-government agencies must comply. Non-government agencies include companies, organisations and individuals that collect, process or use personal data, other than for purely personal or household purposes. Foreign businesses that handle the personal data of people in Taiwan, for example through Taiwanese customers or staff, should also assess whether the PDPA applies to them.

Penalties include administrative fines, civil damages and criminal liability. Since the 2023 amendment, Article 48 allows fines of NT$20,000 to NT$2 million for failing to take adequate security measures, rising to NT$150,000 to NT$15 million where the failure is serious or not corrected in time. Individuals can claim damages, including through group actions, and unlawful use of personal data for gain or to cause harm can be a criminal offence.

Yes. Article 12 requires an agency to notify affected individuals after it has investigated a breach involving theft, disclosure, alteration or other infringement of personal data. Amendments promulgated in November 2025 add a duty for non-government agencies to report qualifying incidents to the Personal Data Protection Commission and keep records, with thresholds and timelines to be set by PDPC regulations.

The amendments passed by the Legislative Yuan in October 2025 and promulgated on 11 November 2025 make the Personal Data Protection Commission the independent supervisory authority, require government agencies to appoint data protection officers and add breach reporting to the PDPC for non-government agencies. The Executive Yuan sets the effective date, and supervision of the private sector moves to the PDPC over a transition period.

The Taiwan PDPA shares core ideas with GDPR, such as purpose limitation, notice, individual rights and security obligations, but it is structured differently. It distinguishes government and non-government agencies, lists specific lawful grounds for collection and use, and relies on sector regulators that can restrict international transfers. Controls built for GDPR or ISO 27001 cover much of the security work but do not replace a PDPA review.

Start by mapping the personal data you hold and the specific purposes and lawful grounds for each use. Then provide notices under Articles 8 and 9, set up processes for access, correction and deletion requests, apply security measures under Article 27, check international transfers and prepare a breach response plan. Check any sector specific security rules issued by your competent authority.

The Taiwan PDPA is mapped in OneClickComply's control library and is available on request. That means controls and evidence you already hold for frameworks such as ISO 27001 or GDPR can be reused against the PDPA requirements, with automated evidence collection, AutoComplete policies and continuous monitoring. OneClickComply does not certify PDPA compliance, but our audit team can advise on gaps.