TaiwanPersonal Data Protection Act (個人資料保護法)
Personal Data Protection Act (個人資料保護法) Laws and Regulations Database of the Republic of China (Taiwan), pcode I0050021, as amended effective
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights, Breach notice, Transfer, Security, Reporting
- Audit expectation
- periodic
- Who audits it
- Regulator
- Where the report goes
- Filed with regulator
What it requires
- Collect, process, or use the personal data of an individual in Taiwan only for a specific purpose and on one of the Act's stated lawful bases, and confine use to the purpose stated at collection unless a further basis under Article 16 or 20 applies.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Notify an affected individual when personal data held has been stolen, altered, damaged, lost, or leaked, and report the incident to the Personal Data Protection Commission where the circumstances fall within the reporting scope the Commission has specified.NIST Privacy FrameworkCM.AW-P7
- Before transferring personal data outside Taiwan, check whether the Personal Data Protection Commission has restricted that transfer under Article 21.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Intentionally violating Article 6 paragraph 1, Article 15, Article 16, Article 19, Article 20 paragraph 1, or a cross-border transfer restriction under Article 21, for unlawful gain or to harm another, and thereby causing harm, carries imprisonment up to five years and a fine up to NT$1,000,000 (Article 41).
Penalty structure
Administrative fines are tiered by violation: NT$50,000-500,000 for core Article 6/19/20/21 violations (Article 47); NT$20,000-200,000 for lesser notice, correction, or breach-notification procedure violations (Article 48, first tier); and NT$20,000-2,000,000, rising to NT$150,000-15,000,000 for a material violation, for security and maintenance plan failures (Article 48, later tiers). The fixed cap is the highest of those bands. The later-tier fines are imposed successively until the violation is rectified.
- Rule
- Fixed only
- As of
- Currency
- TWD
- Fixed cap
- 15,000,000
Statutory damages
Article 28, paragraph 3, extended to non-government agencies by Article 29, lets the court award not less than NT$500 and not more than NT$20,000 per incident, per person where the actual damage is hard to prove; where several data subjects are harmed by the same incident, the total awarded is capped at NT$200 million unless the interests involved exceed that sum, in which case the cap is the value of those interests.
- As of
- Currency
- TWD
- Per person minimum
- 500
Who enforces it
Enforcement body
Personal Data Protection Commission (PDPC)
Settledness
- As of
- Open questions
- When is a violation of the personal data file security and maintenance duties "material" under Article 48, paragraph 3, so that the fine rises from NT$20,000 to NT$2,000,000 up to NT$150,000 to NT$15,000,000, when Article 2 does not define "material"?
What it makes you log
Who may demand the log
Regulator
Logging duty
After a theft, alteration, damage, loss or leak of personal data an agency must take countermeasures, document the facts, impacts and response measures, and keep the records for the competent authority's inspection. The competent authority is to prescribe the content, time limit and record retention by regulation, and the Act states no period, so none is coded. Article 11 also has an agency keep a record of a dispute over the accuracy of data when it goes on using it with the data subject's written agreement, which is a condition of continued use. Government agencies report annually and are audited periodically (Articles 21-1 and 21-2); non-government agencies are inspected when the authority sees fit (Article 22), which the on-request value does not capture alone. Article 51 reaches agencies outside the Republic of China only for the data of its nationals, a nationality test that has no hook value, so the hook is left empty.
- Kind
- Explicit
- As of
- Provision
- Article 12, paragraph 3
- Trigger
- security_incident
What this law does
The PDPA requires government and non-government agencies alike to collect and process personal data only for a specific purpose and on one of the bases the Act states (Articles 15, 16, 19, 20), notify the data subject when personal data held has been stolen, altered, damaged, lost, or leaked and, in specified circumstances, report the incident to the competent authority (Article 12), and implement security and maintenance measures to prevent theft, alteration, damage, loss, or leakage of personal data files (Article 20-1).
Since an amendment effective , the Act's competent authority is the Personal Data Protection Commission, an independent agency, which supervises government agencies through periodic and ad hoc audits (Articles 21-1 through 21-5) and may inspect a non-government agency it deems likely to violate the Act (Article 22).
A non-government agency is civilly liable for injury caused by an unlawful collection, processing, or use of personal data (Article 29), with a statutory minimum of NT$500 per data subject per incident where actual damages cannot be readily shown, and 20 or more affected data subjects may delegate a lawsuit to an incorporated foundation or charity (Article 34).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .