Runs an essential service, in Taiwan

Arts. 15, 42, 75 and 79 of the Telecommunications Management Act (電信管理法), enacted June 26, 2019, effective July 1, 2020 for the provisions cited here · Read the law's page

• This binds a telecommunications enterprise that has established a public switched telecommunications network (PSTN) using allocated telecommunications resources, or another telecommunications enterprise the competent authority separately announces is bound; an enterprise the competent authority has not so designated, and that has not established such a network, carries no duty under this row.
• Draw up an info-communications security maintenance plan covering the management scope and classification of covered systems, compliance-verification measures, plan-implementation measures, and joint-defense and incident-response measures, and implement it.
• Where the competent authority designates the enterprise's PSTN, in whole or in part, as critical telecommunications infrastructure, additionally draw up a critical telecommunications infrastructure protection plan before the competent authority's own deadline, submit it for the competent authority's evaluation before implementing it, and comply with the technical specifications for info-communications security evaluation the competent authority sets for that infrastructure.
• The Ministry of Digital Affairs, not the National Communications Commission, has held the competent-authority role over both duties since Aug. 27, 2022.
• Failing to draw up or implement the general maintenance plan draws a fine of NT$100,000 to NT$1,000,000; failing to submit or implement an approved critical-infrastructure protection plan draws a separate, higher fine of NT$500,000 to NT$5,000,000, which for continued non-correction may be repeated or replaced by abolition of the network approval certificate; the general-plan fine may be repeated for continued non-correction.

Arts. 24 and 29 of the Cyber Security Management Act (資通安全管理法), full-text amendment promulgated Sept. 24, 2025 (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective Dec. 1, 2025 · Read the law's page

• This binds the same specific non-government agency class as the Act's Chapter III sector-regime duties (a designated critical infrastructure provider, government-owned enterprise, designated nationwide foundation, or government-controlled enterprise); no revenue, user-count or other threshold narrows the class further.
• Establish a notification and response mechanism for a cyber security incident before one occurs.
• Notify the central competent authority in charge of the relevant sector as soon as the agency becomes aware of a cyber security incident.
• Submit an investigation, handling and corrective-action report on the incident to that authority, and to the Ministry of Digital Affairs as well where the incident is a major one.
• A failure to report an incident under this duty draws a fine of NT$300,000 to NT$10,000,000, with additional fines imposed for each period the agency remains uncorrected past the ordered deadline.

Arts. 3(6)-(8), 7-8, 20-23 and 30 of the Cyber Security Management Act (資通安全管理法), full-text amendment promulgated Sept. 24, 2025 (Presidential Order Hua-Zong-Yi-Yi-Zi No. 11400095391), effective Dec. 1, 2025 · Read the law's page

• This binds a critical infrastructure provider the government has individually designated under Article 20, or another specific non-government agency (a government-owned enterprise, a designated nationwide foundation, or an enterprise, organization or institution under government control) Article 3(6) defines; a business the competent authority has not placed in one of these designated classes carries no duty under this row.
• Report to the competent authority for approval or recordation of the agency's assigned cyber security responsibility level, based on the sensitivity, volume and nature of the information the agency holds and the scale and nature of its information and communication systems.
• Appoint dedicated cyber security personnel and a Chief Information Security Officer, who may be a representative, manager, other person with authority, or an appropriate designated member of personnel, to promote and oversee the agency's cyber security affairs.
• Formulate, revise and implement a cyber security maintenance plan matching the agency's assigned responsibility level. A critical infrastructure provider must report the plan's implementation status to the central competent authority in charge of the relevant sector, and submit a corrective-action report on any deficiency found; any other specific non-government agency reports implementation status only when that authority requires it, and submits a corrective-action report within a designated period after an audit the authority chooses to run.
• Comply with the central competent authority's audits of the maintenance plan's implementation: a critical infrastructure provider is audited periodically, and any other specific non-government agency may be audited at the authority's discretion; audit results and corrective-action reports are forwarded to the Ministry of Digital Affairs.
• A failure to formulate, implement or report on the plan draws a fine of NT$100,000 to NT$5,000,000 per violation, after an unheeded order to correct within a specified period.

Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents (資通安全事件通報應變及演練辦法), full-text amendment issued Jan. 5, 2026 (Ministry of Digital Affairs Order Shu-Shou-Zi-Fa-Zi No. 1145000415), Arts. 11 and 13 · Read the law's page

• Applies to a specific non-government agency under the Cyber Security Management Act, meaning a designated critical infrastructure provider, a government-owned enterprise, a designated foundation, or an enterprise, organization or institution under government control; reached by declaring that you operate an essential service.
• Report a cyber security incident in the manner the sector's central competent authority designates within one hour after you become aware of it, and keep updating the report if the incident level changes (Article 11(1) and (2)).
• Complete damage-control or recovery operations and notify the sector authority within 72 hours of becoming aware of a level 1 or level 2 incident, or within 36 hours of becoming aware of a major incident (Article 13(1)).
• Submit an investigation, handling and corrective action report to the sector authority within one month after those operations, unless the authority agrees to extend the time (Article 13(2) and (3)).
• Have your Chief Information Security Officer convene a meeting after you become aware of a major incident (Article 14(3)).

Arts. 24-25 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries (金融控股公司及銀行業內部控制及稽核制度實施辦法), full-text revision promulgated May 6, 2026 (Financial Supervisory Commission Order Jin-Guan-Yin-Guo-Zi No. 11502710961), effective on promulgation for the articles cited here · Read the law's page

• This binds a financial holding company or a banking-industry entity (a bank, credit cooperative, bills finance company or trust enterprise) under Financial Supervisory Commission jurisdiction, except that the competent authority's own provisions govern where it has provided otherwise for a credit cooperative or bills finance company, and a Taiwan branch of a foreign bank that operates under its head office system may be exempted from the Article 24 unit and officer requirement (Article 53); an entity outside that class carries no duty under this row.for a financial business
• Establish a dedicated information security unit reporting to the general manager, that does not also handle information-technology operations or any other function creating a conflict of interest, staffed with adequate personnel and equipment.for a financial business
• Appoint a deputy general manager or equivalent as Chief Information Security Officer over that unit, and have that officer report the prior year's overall information-security performance to the board of directors annually and report a material information-security problem promptly when it arises.for a financial business
• Have the dedicated unit plan, manage and execute the information security system to control information security risk, supervise every unit's compliance with it, and build the mechanisms for cyber security protection, threat-intelligence assessment, and cyber security incident notification and response.when it serves a financial business
• Provide the dedicated unit's personnel at least 15 hours, and other information-technology personnel at least 6 hours, of information-security training annually.for a financial business