DIGITAL PRIVACY REGULATIONSThe Worldwide Register of Data Privacy Law
Tracking 197 jurisdictions
Language: English
EnglishEspañolFrançaisDeutschPortuguês
Special · In force · Opt-in · Non-UN jurisdiction

🇹🇼 Taiwan Data Privacy Laws

Taiwan's PDPA dates to 2010 (roots in 1995) and is mid-transformation. 2023 amendments raised penalties and mandated an independent Personal Data Protection Commission, and a further amendment promulgated in November 2025 makes the Commission the sole supervisory authority once a start date is set. Until then the preparatory office works alongside ministry-by-ministry enforcement.

Updated September 28, 2026 · digitalprivacyregs.com
Listing
Jurisdiction with contested UN status · listed alongside the 193 UN member states
Status
In force
Consent model
Opt-in
Primary law
Personal Data Protection Act (PDPA)
Year
2010
Authority
Personal Data Protection Commission (preparatory office; a November 2025 amendment makes it the sole authority from a date not yet set), with sectoral ministries in the meantime
Marketing consent
Consent or a listed statutory basis; notification duties at collection; opt-out must be honored for marketing, and first-use marketing requires a free opt-out channel.
Transfers
Permitted unless restricted by ministries (restrictions exist for some destinations); sectoral rules add localization pockets.
Penalties
2023 amendments raised fines (to NTD 15M for serious security failures) after the iRent breach; criminal exposure for unlawful use.

The framework

Taiwan regulates personal data through the Personal Data Protection Act (PDPA), dating from 2010 and supervised by the Personal Data Protection Commission.

For advertisers the consent posture matters most, and Taiwan sits in the opt-in bloc, where tracking and outreach need permission up front.

Key instruments

Personal Data Protection Act (PDPA)

2010 · In force

Taiwan's PDPA dates to 2010 (roots in 1995) and is mid-transformation. 2023 amendments raised penalties and mandated an independent Personal Data Protection Commission, and a further amendment promulgated in November 2025 makes the Commission the sole supervisory authority once a start date is set. Until then the preparatory office works alongside ministry-by-ministry enforcement.

Marketing and advertising

Consent or a listed statutory basis; notification duties at collection; opt-out must be honored for marketing, and first-use marketing requires a free opt-out channel. Most channel decisions here follow from that consent rule.

Cross-border transfers

Permitted unless restricted by ministries (restrictions exist for some destinations); sectoral rules add localization pockets.

Enforcement and penalties

2023 amendments raised fines (to NTD 15M for serious security failures) after the iRent breach; criminal exposure for unlawful use.

Cite this page: "Taiwan Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/taiwan.html. Accessed [date].