Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Taiwan PDPA

Amended Taiwan · In force Oct 1, 2012 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

MilestoneTentativeNov 11, 2025 · 12 months ago · Source
2025 amendment promulgatedAmendment adds PDPC powers, breach reporting and security duties. Its start date will be set by the Executive Yuan and is not yet known.
Transition endsJan 1, 2024 · 2.8 years ago · Source
PDPC Preparatory Office takes overThe PDPC Preparatory Office takes over PDPA duties from the National Development Council.
Takes effectMay 31, 2023 · 3.4 years ago · Source
Higher fines take effectAmended article 48 with higher fines for security failures takes effect on promulgation.
Takes effectOct 1, 2012 · 14.1 years ago · Source
2010 PDPA rewrite takes effectThe 2010 full rewrite of the Act takes effect, except articles 6 and 54.

Summaries for reference, not legal advice. Check the official text.

What it does

Taiwan's general privacy law for public and private bodies, covering collection, processing and use, special data, data subject rights, breach notice and cross-border transfer limits. The 2023 amendment raised fines and created an independent Personal Data Protection Commission. The 2025 amendment makes the PDPC the sole regulator, adds breach reporting to the PDPC, security maintenance duties and audits, but its start date is still to be set.

Who it applies to
Government agencies and non-government entities (companies, organisations and individuals) that collect, process or use personal data in Taiwan.
Penalties
Since 31 May 2023, security failures by private entities draw fines of NT$20,000 to NT$2 million, then NT$150,000 to NT$15 million for each uncured violation. Other breaches carry fines from NT$20,000 and criminal penalties for unlawful use with intent to profit.
Enforced by
Personal Data Protection Commission (Preparatory Office), with sector regulators during the transition
Official name
Personal Data Protection Act
Citation
Personal Data Protection Act (as amended 11 Nov 2025)
Topics
Privacy, Breach notification
Verified 2026-09-25 law.moj.gov.tw
Research notes

The MOJ database says parts of the Act are not yet in force and the final start date is still to be set (as of the 18 Sep 2026 update). Article 51-1 of the 2025 text lets sector regulators keep supervising some private entities for up to 6 years after the PDPC is set up.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
Questions about Taiwan PDPA
What are the Taiwan PDPA compliance deadlines?
Oct 1, 2012: 2010 PDPA rewrite takes effect. May 31, 2023: Higher fines take effect. Jan 1, 2024: PDPC Preparatory Office takes over. Nov 11, 2025: 2025 amendment promulgated (tentative).
When does Taiwan PDPA take effect?
Taiwan PDPA took effect on Oct 1, 2012.
Who does Taiwan PDPA apply to?
Government agencies and non-government entities (companies, organisations and individuals) that collect, process or use personal data in Taiwan.
What are the penalties under Taiwan PDPA?
Since 31 May 2023, security failures by private entities draw fines of NT$20,000 to NT$2 million, then NT$150,000 to NT$15 million for each uncured violation. Other breaches carry fines from NT$20,000 and criminal penalties for unlawful use with intent to profit.