Data protection & privacy laws in Taiwan (2026)

The ROC President promulgated comprehensive amendments to the Personal Data Protection Act, mandating breach notification to both data subjects and the PDPC, requiring government agencies to designate Data Protection Officers (mirroring GDPR Article 37), and formally constituting the Personal Data Protection Commission. Effective date is to be set by the Executive Yuan.

Taiwan's legislature enacted the most significant PDPA revision in over a decade, adding explicit data-breach notification duties, DPO requirements for public bodies, and formal establishment of the PDPC as a collegial, independent authority — closing a gap the Constitutional Court identified in 2022.

The Preparatory Office of the Personal Data Protection Commission took over responsibility for issuing official PDPA interpretations from the National Development Council, centralising guidance ahead of the PDPC's full constitutional launch.

Taiwan's Financial Supervisory Commission fined Shanghai Commercial & Savings Bank NT$10 million — the heaviest PDPA-related penalty ever imposed by the FSC on a bank — after confirming the bank leaked names and ID numbers of 14,000 customers following a September 2022 cybersecurity incident.

The Legislative Yuan amended the PDPA to raise maximum administrative fines for data-security failures by non-governmental entities from NT$1.5 million to NT$15 million per violation, and designated the incoming Personal Data Protection Commission as the single competent authority, ending the fragmented sector-by-sector enforcement model.

A threat actor listed what was described as the complete Taiwan household registration database — covering the entire population — on BreachedForum; the first time such records were publicly offered for sale. The Ministry of the Interior initially denied the breach before prosecutors opened a confidential investigation.

Taiwan inaugurated the Ministry of Digital Affairs, consolidating data governance, cybersecurity policy, digital-economy regulation, and telecommunications oversight — absorbing functions from the Ministry of Economic Affairs and the Executive Yuan's Department of Cyber Security, and creating the Administration for Cyber Security as a sub-body.

The Constitutional Court ruled that the absence of an independent supervisory authority for personal data placed Taiwan's protection framework at the edge of unconstitutionality, and ordered the legislature to enact the necessary laws and establish such an authority within three years — directly triggering the 2023 PDPA amendment and the PDPC.

The Legislative Yuan passed sweeping amendments that renamed the 1995 Computer-Processed Personal Data Protection Law to the 'Personal Data Protection Act', removed the limitation to computer-processed data, extended the law's reach to all industries, and aligned remedies with the EU Data Protection Directive 95/46/EC.

President promulgated Taiwan's foundational data protection law, modelled on the OECD 1980 Privacy Guidelines and the Council of Europe's 1981 Convention; it applied only to computer-processed personal data in specific regulated sectors (e.g. medical, financial, telecom), establishing the legal baseline that all subsequent PDPA amendments have built upon.