Applicability of the Taiwan Personal Data Protection Act (PDPA)

Taiwan's data protection framework is governed by statutory legislation that regulates the collection, processing, and use of personal information. The Personal Data Protection Act (個人資料保護法) serves as the primary legal instrument for personal data protection in Taiwan.

The Personal Data Protection Act was adopted on May 26, 2010 and became effective on October 1, 2012. This legislation replaced the previous Computer-Processed Personal Data Protection Law, establishing a modernized framework for personal data protection.

The most recent amendments to the act were introduced through legislation adopted on May 31, 2023. These amendments included the addition of Article 1-1, amendments to Articles 48 and 56, and provisions for the establishment of the Personal Data Protection Commission, along with adjustments to fines and institutional arrangements.

The PDPA's applicability is primarily defined through Article 51, which outlines both exclusions and extraterritorial reach:

PDPA Article 51:

"The PDPA does not apply to the following circumstances:

1. where personal data is being collected, processed, or used by a natural person purely for purposes of personal or household activities; or
2. where audio-visual data is collected, processed, or used in public places or public activities and not connected to other personal data.

The PDPA also applies to the government and the non-government agencies outside the territory of the Republic of China (R.O.C) when they collect, process or use the personal data of the R.O.C. nationals."

Material Scope

The PDPA's material scope encompasses two key exclusions:

Personal/Household Activities The law excludes personal data processing by natural persons when conducted solely for personal or household purposes. This creates a clear boundary between regulated data processing activities and private individual use.

Public Audio-Visual Data A specific exemption exists for audio-visual data collected in public spaces or during public activities, provided such data remains disconnected from other personal information. This exclusion recognizes the practical necessity of public photography and videography while maintaining protections when such data becomes linked to other personal identifiers.

Territorial Scope

The PDPA implements a broad territorial reach through two main mechanisms:

Domestic Application The law applies to all data processing activities within Taiwan's territory, covering both government and private sector entities.

Extraterritorial Effect The PDPA explicitly extends its jurisdiction to foreign entities (both governmental and non-governmental) when they process personal data of Taiwanese nationals, establishing a data subject-based approach to extraterritorial application.