Cybersecurity regulation in Taiwan (2026)

Taiwan's National Security Bureau reported that Chinese state-linked cyber operations reached an average of 2.63 million intrusion attempts per day in 2025 — a 113% jump from 1.23 million in 2023 — with attacks coordinated to coincide with 23 of China's 40 military patrol exercises and targeting telecom networks, hospitals, and the defence supply chain.

The first CSMA revision (Legislative Yuan passed 29 Aug; President promulgated 24 Sep 2025) took effect, formally designating MODA as competent authority, mandating CISO appointments and dedicated cybersecurity staff at covered non-government entities, tightening outsourcing controls, granting MODA investigative powers, and doubling maximum incident-reporting fines to TWD 10 million.

Cabinet approved a NTD 8.8 billion (≈ USD 301 million) four-year plan organised around four pillars: whole-of-society resilience, critical-infrastructure joint defence, domestic industry alignment with international standards, and AI-driven threat detection — the largest dedicated cybersecurity investment in Taiwan's history.

The Preparatory Office of the PDPC opened on 5 December 2023 and assumed interpretive authority over the PDPA from the National Development Council on 1 January 2024, creating Taiwan's first dedicated data-protection supervisory authority and a key complement to CSMA enforcement.

Taiwan's Financial Supervisory Commission fined Shanghai Commercial & Savings Bank TWD 10 million — the heaviest cybersecurity-related banking penalty in Taiwan to that point — after a breach exposed names and national ID numbers of approximately 14,000 customers, signalling escalating financial-sector enforcement priorities.

MODA launched as a dedicated cabinet-level body consolidating digital, telecommunications, and cybersecurity oversight; it houses the Administration for Cyber Security and the new National Institute of Cyber Security (NICS), centralising authority previously dispersed across NICST, NCC, and NICI.

Attackers directed up to 8.5 million requests per minute at Taiwan's presidential-office website and government English portal coinciding with U.S. House Speaker Nancy Pelosi's arrival; convenience-store displays and railway stations were simultaneously defaced, demonstrating coordinated use of cyber operations as a geopolitical pressure tool.

The sixth consecutive four-year national cybersecurity programme expanded sector-specific security requirements, strengthened NCCST's incident-response mandate, and reinforced protections across nine designated critical-infrastructure sectors, building on two decades of phased governmental planning since 2001.

The CSMA, Enforcement Rules, Incident Reporting and Response Regulations, and Classification of Cybersecurity Responsibility Regulations became simultaneously effective, imposing binding obligations — risk assessments, annual cybersecurity plans, and mandatory breach reporting — on all government agencies and designated critical-infrastructure providers.

The Executive Yuan created the National Information and Communication Security Taskforce (NICST) and promulgated the first four-year national information-security plan; in March 2001 the National Center for Cyber Security Technology (NCCST) was established to provide incident response and technical support — the foundational institutions underpinning all subsequent cybersecurity governance.