Taiwan has recently taken a major step to strengthen its personal data protection framework with significant amendments to the Personal Data Protection Act (PDPA), officially promulgated on November 11, 2025. These changes are designed to enhance regulatory oversight, align with global privacy norms, and improve safeguards for individuals’ personal information.
Key updates include:
- Creation of an independent regulator – The amendments establish the Personal Data Protection Commission (PDPC) as Taiwan’s dedicated authority for supervising personal data protection. This shifts oversight from multiple agencies to a single, specialized body.
- Breach notification and reporting duties – New rules require mandatory reporting of personal data breaches to the PDPC and affected individuals, tightening accountability for both government and non-government entities.
- Stronger compliance obligations – Non-government agencies will be required to follow baseline security and data management rules set by the PDPC, with significant fines for failures.
- Expanded enforcement powers – The PDPC will be empowered to perform administrative inspections and enforce corrective actions to ensure compliance.
- Government data governance changes – Public agencies will be required to appoint Data Protection Officers (DPOs) and bolster internal compliance structures.
In conclusion: These amendments are expected to come into effect after the Executive Yuan sets an official effective date, likely during 2026. They mark a significant evolution in Taiwan’s privacy regime and position the country closer to international data protection best practices.
More details on this development could be found on the homepage of the Office of the Personal Data Protection Commission (PDPC):
https://www.pdpc.gov.tw/News/20/