Regulationsby GlyphJurisdiction
Taiwan: data, AI and cyber laws
Part of APAC.
Regulations
Add to calendar
Taiwan AI Basic ActTaiwan's framework law for AI. It sets seven principles (including privacy, security, transparency, fairness and accountability), names the National Science and Technology Council as the lead authority, and has the Ministry of Digital Affairs build a risk classification framework that sector regulators use for risk-based rules. High-risk AI must carry warnings, and the government must set liability and remedy rules for high-risk AI.Next: Jan 14, 2028 Agencies must align laws with the Act · in 15 monthsTaiwan PDPATaiwan's general privacy law for public and private bodies, covering collection, processing and use, special data, data subject rights, breach notice and cross-border transfer limits. The 2023 amendment raised fines and created an independent Personal Data Protection Commission. The 2025 amendment makes the PDPC the sole regulator, adds breach reporting to the PDPC, security maintenance duties and audits, but its start date is still to be set.In effect since Oct 1, 2012
Upcoming deadlines
Past deadlines
Taiwan AI Basic ActAI Basic Act in forcePromulgated and in force on the same day (art. 20).TaiwanTaiwan PDPA2025 amendment promulgatedAmendment adds PDPC powers, breach reporting and security duties. Its start date will be set by the Executive Yuan and is not yet known.TaiwanTaiwan PDPAPDPC Preparatory Office takes overThe PDPC Preparatory Office takes over PDPA duties from the National Development Council.TaiwanTaiwan PDPAHigher fines take effectAmended article 48 with higher fines for security failures takes effect on promulgation.TaiwanTaiwan PDPA2010 PDPA rewrite takes effectThe 2010 full rewrite of the Act takes effect, except articles 6 and 54.Taiwan