In response to Constitutional Court Judgment No. 111-Hsien-Pan-13 (2022), the Taiwanese Government plans to establish a Personal Data Protection Commission (PDPC) to create an independent supervisory mechanism for personal data matters in Taiwan. In May 2023, the Personal Data Protection Act (PDPA) was amended to designate the PDPC as the competent authority responsible for enforcing the PDPA, and a preparatory office (the Prep Office) was established to facilitate this transition. In December 2024, the Government proposed further amendments to the PDPA in anticipation of the PDPC's establishment. The draft amendment (the Amendment) is currently open for public comment until February 18, 202
Insight
Taiwan: Personal Data Protection Act - upcoming changes you need to know
February 4, 2025
Summary
Taiwan is set to establish a Personal Data Protection Commission (PDPC) as the sole data protection authority by August 2025, following a Constitutional Court judgment and subsequent amendments to the Personal Data Protection Act (PDPA). The PDPC will assume regulatory powers from sectoral regulators and municipal governments over a six-year transition, with a focus on administrative inspections and data breach notifications. The PDPA amendments introduce mandatory data breach reporting to the PDPC, thresholds for notifying affected data subjects, and the appointment of data protection officers and auditors in government and certain private businesses. High-risk industries will be prioritized for administrative inspections, and the PDPC will provide further guidance on compliance and enforcement. Private businesses are advised to enhance personal data protection compliance in anticipation of these changes.