← Global Privacy Laws Research Library
Personal Data Protection Act
Personal Data Protection Act: Taiwan
Prepared by Shubhank Suman · Last reviewed
CURRENT BASE REGIME; 2025 AMENDMENTS NOT YET FULLY EFFECTIVE
- Legal character
- National statute
- Region
- Asia-Pacific
What it covers
Taiwan's PDPA governs:
- collection
- processing
- use
- sensitive personal data
- notice
- individual rights
- security
- international transfers
- government and non-government agencies.
The official Personal Data Protection Commission database currently identifies the PDPA as the principal statute. (pdpc.gov.tw)
Why it matters
The Act is broad and technology-neutral. It applies to both government and non-government agencies and regulates both automated and non-automated data files.
Refer to it when
- Processing Taiwanese personal data
- sensitive-data processing
- employee data
- health/genetic data
- financial data
- international transfers
- access/correction
- data security
- AI/profiling.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH / INDIRECT
The Act is not an AI statute.
Its relevance increases when AI uses:
- biometric data
- health data
- genetic information
- behavioural data
- profiling
- automated analytics.
Cybersecurity
HIGH
Security obligations cover technical and organisational protection of personal data.
Applicability
Government and non-government agencies subject to the Act, with specific territorial rules.
Current validity
CURRENT, but the 11 November 2025 amendment has provisions whose effective date remains to be determined. (PDPC Law)
Read first
Articles 1–3 → Article 6 → Articles 8–13 → Articles 19–21 → Article 27 → 2025 amendment/commencement status.
Provisions / sections covered
Article 1: Purpose
Regulates collection, processing and use of personal data to protect personality rights while permitting appropriate data use. (pdpc.gov.tw)
Article 2: Definitions
Defines personal data broadly, including:
- identifiers
- fingerprints
- health records
- genetic information
- criminal records
- financial information
- social activities
- other information capable of directly/indirectly identifying a person.
(pdpc.gov.tw)
Article 3: Data-subject rights
Includes:
- access
- copies
- correction
- cessation of collection/processing/use
- deletion.
Articles 8–9: Information obligations
Require specified transparency information when data is collected directly or indirectly.
Article 6: Sensitive personal data
Covers categories including:
- medical information
- healthcare
- genetics
- sex life
- criminal records
- health examinations.
Articles 19–20: Non-government agencies
Govern processing/use by private organisations and provide lawful conditions for collection and subsequent use.
Article 21: International transfers
Provides restrictions on specified international transfers.
Article 27: Security
Requires appropriate security measures.
IMPORTANT CURRENT-STATUS ISSUE
This entry requires particularly careful version control.
Taiwan amended significant provisions on 11 November 2025, but the official law database expressly states:
the amended provisions have not yet all entered into force.
The latest amendment therefore must not simply be presented as though every provision is already operative. (PDPC Law)
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Profiling
- Security
- Cross-border transfers
- Data protection officer
- Biometrics
- Health data
- Employment data
- Government data
- Enforcement and penalties
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.