On 17 October 2025, Taiwan’s Legislative Yuan passed amendments to the Personal Data Protection Act (PDPA), establishing the Personal Data Protection Commission (PDPC) as the new supervisory authority for personal data matters.
These changes respond to a 2022 Constitutional Court ruling and aim to strengthen independent oversight while enhancing data protection standards across both public and private sectors.
Key updates include mandatory appointment of Data Protection Officers (DPOs) for government agencies, new breach notification and reporting obligations for non-government entities, expanded inspection powers for the PDPC, and a six-year transition period for certain supervisory functions.
The PDPC will also issue baseline security regulations and serve as the appeals body for administrative decisions. The effective date will be set by the Executive Yuan, with implementation expected in 2026.