Law: The Personal Data Protection Act 2010 (as amended in 2015) (PDPA)

Regulator: The National Development Council (NDC)

Summary: Data protection in Taiwan is governed by the Personal Data Protection Act 2010 (as amended in 2015) (PDPA) and the Enforcement Rules of the Personal Data Protection Act (the Enforcement Rules). The PDPA is a comprehensive data protection law which covers the activities of government agencies and non-government agencies including data transfers and breach notification. In addition, data subjects are provided with rights including a right to access, rectification, and deletion.

Although the National Development Council (NDC) is the lead regulator when it comes to interpreting the PDPA, enforcement falls under industry-specific regulators. On June 2, 2023, amendments to the PDPA entered into effect. The amendments update Article 48 of the PDPA in regard to violations of security obligations and establish an independent supervision mechanism. The NDC confirmed that the Executive Yuan will promptly establish a preparatory office for the Personal Data Protection Commission.