Taiwan PDPA
Amended Taiwan · In force Oct 1, 2012 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Taiwan's general privacy law for public and private bodies, covering collection, processing and use, special data, data subject rights, breach notice and cross-border transfer limits. The 2023 amendment raised fines and created an independent Personal Data Protection Commission. The 2025 amendment makes the PDPC the sole regulator, adds breach reporting to the PDPC, security maintenance duties and audits, but its start date is still to be set.
- Who it applies to
- Government agencies and non-government entities (companies, organisations and individuals) that collect, process or use personal data in Taiwan.
- Penalties
- Since 31 May 2023, security failures by private entities draw fines of NT$20,000 to NT$2 million, then NT$150,000 to NT$15 million for each uncured violation. Other breaches carry fines from NT$20,000 and criminal penalties for unlawful use with intent to profit.
- Enforced by
- Personal Data Protection Commission (Preparatory Office), with sector regulators during the transition
- Official name
- Personal Data Protection Act
- Citation
- Personal Data Protection Act (as amended 11 Nov 2025)
- Topics
- privacy, breach-notification
Research notes
The MOJ database says parts of the Act are not yet in force and the final start date is still to be set (as of the 18 Sep 2026 update). Article 51-1 of the 2025 text lets sector regulators keep supervising some private entities for up to 6 years after the PDPC is set up.
Related
Questions about Taiwan PDPA
- What are the Taiwan PDPA compliance deadlines?
- Oct 1, 2012: 2010 PDPA rewrite takes effect. May 31, 2023: Higher fines take effect. Jan 1, 2024: PDPC Preparatory Office takes over. Nov 11, 2025: 2025 amendment promulgated (tentative).
- When does Taiwan PDPA take effect?
- Taiwan PDPA took effect on Oct 1, 2012.
- Who does Taiwan PDPA apply to?
- Government agencies and non-government entities (companies, organisations and individuals) that collect, process or use personal data in Taiwan.
- What are the penalties under Taiwan PDPA?
- Since 31 May 2023, security failures by private entities draw fines of NT$20,000 to NT$2 million, then NT$150,000 to NT$15 million for each uncured violation. Other breaches carry fines from NT$20,000 and criminal penalties for unlawful use with intent to profit.