TAIWAN Law and Practice Contributed by: Che-Hung Chen, Doris Lu, Jakob Huang and Meng-Ying Lee, Chen & Lin
5.4 Blocking Statutes In Taiwan, cross-border disclosures or foreign dis - covery requests are subject to restrictions under the PDPA, when personal data is involved. Execution of foreign-court judgments in Taiwan typically requires going through procedures under Taiwan laws. Rec - ognition of foreign judgments is governed under the Code of Civil Procedure, which requires proper juris - diction, due process, public policy compliance and reciprocity. Additionally, national security laws (eg, the National Security Act) may restrict cross-border disclosures or co-operation if the information relates to national security matters. 5.5 Recent Developments In addition to those described in 5.1 Restrictions on International Data Transfers to 5.3 Data Localisation Requirements , on 30 September 2025, the Ministry of Health and Welfare announced “the restriction on the international transfer of personal data by the whole - sale and retail pharmaceutical industry to China, Hong Kong, and Macau”. It is stipulated that the wholesale and retail pharmaceutical industry shall not transfer the personal data it collects, processes and uses to China, Hong Kong and Macau unless an exception applies. This regulation will take effect on 1 October 2026 to govern specific pharmaceutical wholesale and retail operators and will extend to all pharmaceutical wholesale and retail operators from 1 October 2027.
domestic companies. Under the amended regime, not only outbound investments meeting prescribed trans - action value thresholds, but also investments involving designated countries or territories, or specified indus - tries or technologies, are subject to prior approval by the competent authority. In conducting its review, the authority will assess, among other factors, the poten - tial impact of the proposed investment on national security and economic development. Taken together, these regulations indicate that Taiwanese laws and regulations are evolving toward a more comprehen - sive and substantive framework for the protection of non-personal data, particularly from the perspective of technology and national security protection. 5.3 Data Localisation Requirements As stated in 5.1 Restrictions on International Data Transfers , international data transfers are in gener - al permitted by the PDPA, while it leaves the room and flexibility to the relevant competent authority to impose restrictions at its discretion based on the regulation and management needs of the specific industry. Therefore, the relevant competent authority may still promulgate sector-specific rules governing data localisation for a specific industry. Please see 5.1 Restrictions on International Data Transfers and 5.2 Government Notifications and Approvals for details. The current regulatory regime is silent as to whether remote access constitutes a “transfer” and the rel - evant authorities have not provided written interpreta - tion for this matter, although it seems that this may be the case. This view relies on a boarder interpretation of the PDPA, under which an “international transfer” is defied to include cross-border “processing” or “use” of personal data. If so characterised, the regulatory requirements applicable to cross-border transfers under the PDPA would correspondingly apply to sce - narios involving remote access. In light of this evolv - ing regulatory stance, cross-border enterprises are advised to closely monitor further developments on this issue and evaluate any potential impacts which might impact their global and cross-border data pro - tection structure, designs and measures.
490 CHAMBERS.COM
Powered by FlippingBook