Taiwan

No single dedicated authority. National Development Council and sector regulators share oversight. Reform to establish dedicated authority.

Written consent for certain sensitive data. Collection must have specific purpose and lawful basis.

Rights to access, correction, deletion, cessation of collection/processing/use, and supplementation.

Central authority may restrict transfers to specific countries. International cooperation requirements.

Must notify data subjects after discovery of breach.

Must designate person for data protection. Larger organisations expected to have formal roles.

General provisions apply. No specific age-based threshold.

Administrative fines up to TWD 50 million. Criminal penalties for certain violations.

FSC financial data rules, health data regulations, NCC telecom requirements.

General consent requirements apply.

General data protection provisions apply. AI governance framework developing.

Some sector-specific localisation for financial and health data.

No equivalent concept.

PDPA applies to government agencies with specific provisions.