Personal Data Protection Act

Taiwan's PDPA applies to public and private entities collecting, processing or using personal data, with Article 51(2) extending it to the personal data of Taiwan nationals collected, processed or used outside Taiwan by a Taiwanese natural or legal person — a nationality-and-actor anchor rather than a targeting test, so a purely foreign business with no Taiwanese entity is generally outside its reach and the trigger below reflects established presence only. The 2023 amendment removed the previous ceiling on administrative fines and mandated creation of an independent supervisory authority; the Personal Data Protection Commission has been standing up through a preparatory office, and enforcement has until now been distributed across sector regulators. A larger amendment followed on November 11, 2025, rewriting a long list of articles (including Arts. 1-1, 12, 18 and 21-26) and adding new ones to constitute the Commission as the competent authority, centralise supervision, and carry a transition of regulatory authority over a period of years. It is not yet operative: the national law database records its commencement as 'to be determined by the Executive Yuan', and no such date had been set as of September 2026. Plan for two regimes, and confirm the Commission's current operational status before relying on either.