TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
In addition, the PDPA and related regulations govern change-of-control arrangements, data transfers and post-closing integration activities involving personal data. By way of example, where a proposed transac - tion involves the transfer of personal data, key matters to be considered and addressed include the catego - ries of data involved, the destination of the transfer and the applicability of any required notices, consents and/or regulatory approvals etc.
charge of the pertinent industry from transferring their subscribers’ or their clients’ personal data to China. With respect to non-personal data, there is current - ly no unified or dedicated legislation in Taiwan that specifically governs the details of cross-border data transfers. However, consistent with the global trend toward strengthening the protection of national secu - rity and critical technologies, Taiwanese laws – includ - ing the National Security Act, the Trade Secrets Act and other relevant legislation – may apply to prevent the unlawful disclosure or leakage of such data to restricted territories, foreign hostile forces or any per - sons or entities controlled by them. Violations of these laws may give rise to severe criminal liability. 5.2 Government Notifications and Approvals The relevant competent authority may promulgate sector-specific rules governing international data transfers for a specific industry. For example, as described in 5.1 Restrictions on International Data Transfers , the laws and regulations impose a locali - sation principle for customers’ finance records. If a financial institution wishes to outsource its data entry, processing and the output operations of an informa - tion system related to consumer finance business to an offshore service provider, it must submit the appli - cation with required materials, including the internal outsourcing guidance and board resolution which allows and approves such international transfer, and necessity analysis and corresponding rules and plan for subsequent management and emergency han - dling, etc, to the FSC for approval. With respect to non-personal data, Taiwanese laws and regulations also impose certain management and control measures. In particular, prior approval from the Department of Investment Review of the Ministry of Economic Affairs is required where a Taiwanese indi - vidual or legal entity intends to transfer or license its technology, patents, know-how or other intellectual property, whether or not registered with the relevant authority, to a China individual or entity. Further, the amendments to the Industrial Innovation Statute, which came into effect on 7 May 2025, reflect the global trend toward enhanced protection of critical technologies and significantly strengthen the regula - tory framework governing outbound investments by
5. International Considerations 5.1 Restrictions on International Data Transfers
For personal data, under the PDPA, “cross-border transfer” refers to the cross-border processing or use of it. In general, cross-border transfer of personal data is permitted, while the government authority in charge of the pertinent industry may, at its reasonable discre - tion, impose limitations on international data transfers if: • they involve important national interests; • a national treaty or agreement specifies otherwise; • the country receiving the personal information lacks proper regulations towards the protection of personal information and it might harm the rights and interests of the data subject; or • international transfers of personal information are made through an indirect method in which the pro - visions of the PDPA may not be applicable. Pursuant to the above provision and relevant laws gov - erning particular industries, certain authorities further promulgate and require certain data residency/data localisation requirements whose nature will impose certain restrictions on international data transfer. For example, the FSC promulgates certain data residency requirements for financial institutions. In addition, certain authorities promulgate and impose restrictions in terms of which certain specific indus - tries are prohibited from transferring data to a specific territory. For example, communications enterprises, social worker offices or human resource agencies are prohibited by respective governmental authorities in
489 CHAMBERS.COM
Powered by FlippingBook