Taiwan: Strengthens Data Privacy Framework with PDPA Amendments
Taiwan’s Legislative Yuan has passed key amendments to the Personal Data Protection Act (PDPA), marking a significant milestone in the country’s data privacy regime. The changes empower the Personal Data Protection Commission (PDPC) and the Personal Information Services Authority (PISA) with supervisory and enforcement powers, while introducing tailored transition periods for public and private sectors, which was announced on 17 October 2025.
The PDPA amendments, which completed their third reading in the Legislative Yuan, were first proposed by the Executive Yuan in March 2015. The Preparatory Office of the PDPC expressed appreciation to lawmakers and stakeholders for their collaboration and contributions during the legislative process.
Key Updates
According to the PDPC, the amended PDPA introduces several major changes:
Empowers the Personal Information Services Authority (PISA) with supervisory responsibilities.
Strengthens data protection oversight and management in the public sector.
Establishes sector-specific transition periods to help private organizations adapt to the new rules.
These updates aim to enhance Taiwan’s overall data governance framework, aligning it more closely with international privacy standards.
Next Steps for Implementation
Although the amended PDPA has been approved, the Personal Data Protection Commission cannot be formally established until the Organization Act — which defines its structure and functions — is passed. This Act is currently under review by the Legislative Yuan’s Judiciary and Legislative Affairs Committee.
The Executive Yuan will determine the implementation date of the amended PDPA based on the legislative progress of the Organization Act and the time needed for administrative preparations.
Additional Regulations to Follow
The PDPC noted that several new operational and supervisory systems will be introduced under the amended PDPA. Consequently, additional sub-laws and administrative announcements will be required.
Once drafted, these will undergo public consultation to gather feedback from industry and stakeholders. The process will be coordinated with the formal establishment of the PDPC to ensure smooth transition and effective enforcement.
The PDPC stated that these developments will strengthen Taiwan’s data protection framework and improve supervisory capabilities, reinforcing the nation’s commitment to safeguarding personal information.
Official press released is available - here