Taiwan PDPA

Taiwan Personal Data Protection Act - rights, consent, cross-border transfer, sensitive data.


Short name	TW PDPA
Region	Asia-Pacific
Country or scope	Taiwan
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers TW PDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for TW PDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for TW PDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TW-PDPA-27` Proper Security Measures	Non-government agencies holding personal data must adopt proper security measures to prevent the data from being stolen, altered, damaged, destroyed or disclosed, including integrity assurance for the processing software (PDPA Art. 27(1))	Scan
`TW-PDPA-27-PLAN` Security and Maintenance Plan	The competent authority may require a security and maintenance plan for personal data files, and the enforcement rules enumerate technical measures such as data-security and equipment-security management, which require tracked component versions (PDPA Art. 27(2) and Enforcement Rules security-measure catalogue)	Scan
`TW-PDPA-18` Dedicated Security Personnel	Government agencies keeping personal data files must assign dedicated personnel to handle security and maintenance, so security documentation must record an accountable contact (PDPA Art. 18)	Scan
`TW-PDPA-12` Breach Notification Readiness	When personal data is stolen, disclosed, altered or otherwise infringed, the agency must notify the affected data subjects after investigation, which requires quickly determining whether deployed components match a disclosed vulnerability (PDPA Art. 12)	Scan
`TW-PDPA-OUT` Supervision of Commissioned Processing	Agencies commissioning third parties to collect or process personal data must properly supervise the commissioned party, which requires knowing the suppliers behind the processing software (PDPA commissioning provisions and Enforcement Rules supervision requirements)	Scan
`TW-PDPA-INV` Inventory of Processing Systems	Proper security measures presuppose that the agency knows which software components process personal data, so those components must be inventoried (PDPA Art. 27 security-measures obligation)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PDPA-5`	Lawful Collection Principles
`PDPA-6`	Sensitive Personal Data
`PDPA-8`	Notice to Data Subject
`PDPA-19-20`	Indirect Collection & Secondary Use
`PDPA-27-28`	Security Safeguards
`PDPA-41`	Cross-Border Transfer Restrictions
`PDPA-DSR`	Data Subject Rights Management

Policy templates

Written for TW PDPA:

Taiwan PDPA Privacy Notice
Taiwan PDPA Breach Notification Procedure

And 22 from the standard set, adapted to TW PDPA.