Personal Data Protection Act — restrictions on international transmission of personal data

Taiwan does not impose a general prohibition on exporting personal data. Art. 21 instead gives the competent authority a discretionary POWER to restrict international transmission in defined circumstances, and that power has historically been exercised sector by sector, by the ministry regulating the industry concerned, rather than through a standing adequacy regime. The practical consequence is the reverse of most regimes here: the default is permission, and the compliance question is whether a restriction has been issued for your sector and destination — which means checking the relevant industry regulator, not a central list. The November 2025 amendments move that power to the new Personal Data Protection Commission, centralising it — but they are not yet operative: the national law database records their commencement as still to be determined by the Executive Yuan, checked September 2026. Marked 'check': the specific statutory grounds on which a restriction may be imposed were not verified against the primary text, and the sector-by-sector inventory of restrictions actually in force could not be assembled from a single source.