On November 11, 2025, the President promulgated amendments to certain provisions of the Personal Data Protection Act (the “PDPA”). These amendments were introduced in response to the establishment of the Personal Data Protection Commission (It’s a Preparatory Office before the Commission officially established, hereinafter the “PDPC Preparatory Office”) and to adjust and supplement the relevant regulatory framework to vest the PDPC Preparatory Office with necessary supervisory and enforcement authority. The amendments strengthen oversight of personal data protection for both government agencies and non-government agencies (i.e., private-sector entities). Transitional periods are also provided for non-government agencies to facilitate compliance and adjustment.

I. Notification and Reporting Obligations

Where a non-government agency becomes aware that personal data in its possession has been stolen, leaked, or otherwise involved in a personal data breach, it is required to notify the affected data subjects and report the incident to the competent authority.

II. Administrative Inspections

Where the competent authority considers that a non-government agency may have violated the PDPA, or deems it necessary to assess the agency’s compliance with the PDPA, it may conduct inspections in accordance with law. The authority may also require relevant personnel to provide necessary explanations, cooperate with required measures, or submit relevant supporting documentation.

III. Remedies

If a non-government agency disagrees with an administrative disposition imposed by the competent authority under the PDPA, it may file an objection with the authority. Where an objection is not permitted by law, the agency may directly initiate administrative litigation to seek relief.

Although the amended provisions have been promulgated, their effective date will be separately determined by the Executive Yuan pursuant to Article 56, Paragraph 1 of the PDPA. Enterprises are advised to promptly review their existing data processing practices, incident reporting procedures, and information security safeguards, in order to prepare for the forthcoming implementation of the amendments.

‍

References

1. Presidential Order Hua-Zong-Yi-Jing No. 11400114521, promulgated on November 11, 2025.

2. Personal Data Protection Commission Preparatory Office, “Legislative Yuan Passes Third Reading of Amendments to Certain Provisions of the Personal Data Protection Act,” October 17, 2025, https://www.pdpc.gov.tw/News_Content/20/1001/, last accessed November 24, 2025.