Taiwan PDPA and Cyber Security Management Act: What the 2025 Amendments Mean for Security Teams

Taiwan amended both of its core data and cyber laws in 2025: the Cyber Security Management Act (CSMA) was promulgated on 24 September 2025 and the Personal Data Protection Act (PDPA) on 11 November 2025, and both create new duties that land on security teams, from breach reporting to a new independent regulator to restrictions on risky products. The amended CSMA has been in force since 1 December 2025, under Executive Yuan Order 1141033966 (Taipei City Government Laws and Regulations Database; Legal 500). The PDPA amendments still had no effective date when this guide was checked, so for the PDPA organisations are in a preparation window. This guide explains who each law covers, what changes, what is still waiting on regulations, and how to prepare, including for the service accounts, keys and AI agents that touch personal data and critical systems. It is written for security, privacy and engineering leads with operations, suppliers or customers in Taiwan, including in the semiconductor and electronics supply chain.

Source note: the official English texts on the Ministry of Justice Laws and Regulations Database could not be accessed for this guide. It is based on named secondary sources: K&L Gates (January 2026), Jones Day (December 2025), Baker McKenzie (October 2025 alerts on both laws), Lee and Li, Asia Pacific Law Japan (March 2026) and the Legal 500 Taiwan data protection and cybersecurity guide. The CSMA effective date is taken from the Taipei City Government Laws and Regulations Database, which reproduces the Executive Yuan order. Each obligation names its source. Penalty figures and dates are included only where two independent sources agree. Confirm against the official text before relying on it.

Key takeaways

• Two laws, two regulators: the PDPA amendments move personal data supervision to a new independent Personal Data Protection Commission (PDPC); the CSMA amendments make the Ministry of Digital Affairs (MODA) the competent authority for cyber security (K&L Gates; Baker McKenzie; Lee and Li).
• CSMA in force, PDPA still pending: the amended CSMA took effect on 1 December 2025 (Taipei City Government Laws and Regulations Database; Legal 500). K&L Gates, Jones Day and Asia Pacific Law Japan report that the Executive Yuan will set the PDPA effective date, and no date had been set when this guide was checked. Check the current status before planning deadlines.
• Breach reporting to the regulator is new: private sector organisations already notify affected individuals; the amended PDPA adds reporting to the PDPC for incidents that meet thresholds the PDPC will set by regulation.
• Penalties rise on the cyber side: the maximum fine under the CSMA for failing to report a cyber security incident goes to NT$10 million (Baker McKenzie; Lee and Li).
• A long transition: some private sectors stay with their current regulators for up to six years after the PDPC is established (Baker McKenzie; Asia Pacific Law Japan).

Scope: who each law covers

For a business that is not a critical infrastructure provider or government-linked, the PDPA is the main law. For suppliers to critical infrastructure providers, the CSMA still matters indirectly through outsourcing contract terms and drills, described below. Taiwan sits in our Global Privacy Regulatory Map alongside other Asia Pacific regimes such as the China PIPL.

PDPA: what the 2025 amendments change

A new independent regulator

Baker McKenzie explains that the amendments respond to a Constitutional Court ruling of 12 August 2022 that called for an independent data protection supervisory mechanism. A 2023 amendment named the PDPC as the competent authority, and its Preparatory Office was set up on 5 December 2023. The PDPC becomes official once its Organisational Act is passed. Under Article 51-1, some private sectors, likely those with existing sector regulators, stay with those regulators or local governments for up to six years after the PDPC is established, with the PDPC reviewing the scope every two years (Baker McKenzie; Asia Pacific Law Japan on the six-year period).

Breach notification and reporting (Article 12)

• Individuals: non-government agencies must notify affected individuals when personal data is stolen, altered, damaged, lost or leaked, which already applies under the current law (K&L Gates). Jones Day notes that the duty arises on becoming aware of a breach and is not conditioned on first establishing all the facts.
• Regulator: organisations must also report to the PDPC where an incident meets reporting criteria set by regulation. The threshold and time limit are still to be set (K&L Gates; Baker McKenzie). Jones Day compares this to GDPR Article 33(1).
• Remediation and records: organisations must take immediate remedial steps and record the facts, impact and measures taken, keeping the records for PDPC inspection (K&L Gates; Baker McKenzie).
• Fines: failing to report to the regulator can attract a fine of NT$20,000 to NT$200,000, and the fine can be repeated if the problem is not fixed by the deadline (K&L Gates; Baker McKenzie).

Security measures (Article 20-1)

Non-government agencies holding personal data files must keep implementing security measures. The PDPC will issue baseline regulations on the security and maintenance of personal data files; during the transition, sector regulators' rules must follow that baseline but may be stricter (Baker McKenzie; K&L Gates).

Inspections (Article 22)

The PDPC may request explanations and documents or inspect on site, including without a prior indication of a violation, and organisations cannot refuse without justifiable reasons (Baker McKenzie; K&L Gates). Inspectors may copy or retain evidence.

Data protection officers (Article 18)

Government agencies must designate a data protection officer. A proposal to extend this to certain private entities was dropped (Baker McKenzie; Jones Day). Many private organisations will still want a named privacy lead to own breach reporting and inspection readiness.

CSMA: what the 2025 amendments change

The CSMA has applied since 1 January 2019 and the 2025 amendment is its first revision (Lee and Li). The main changes for covered entities, as reported by Baker McKenzie and Lee and Li:

• Competent authority: moves from the Executive Yuan to MODA.
• People: appoint a chief information security officer or cyber security officer and dedicated full-time cyber security staff.
• Outsourcing: sign written contracts with contractors that set out rights, duties and liability, and ensure contractors have adequate security measures or third-party certification (Baker McKenzie; Lee and Li on written contracts).
• Drills: cooperate with MODA-planned cyber security drills.
• Risky products: government agencies may not use products that endanger national cyber security, and sector authorities may restrict or prohibit their use by specific non-government agencies, with case-by-case approval where no alternative exists.
• Investigations: after a major incident, authorities may inspect on site and require third-party forensic reports; entities and their contractors must not obstruct this.
• Penalties: the maximum fine for failing to report an incident rises to NT$10 million (both sources).

Neither source states the incident reporting deadline. Read MODA's current implementing rules for the timing that applies to your responsibility level.

Why it matters for the semiconductor and electronics supply chain

Taiwan's technology manufacturers sit inside many global supply chains, so these laws reach well beyond Taiwanese companies. Three practical effects, in our view:

• Contract flow-down: CSMA-covered entities must put security terms in written contracts with contractors, so suppliers, managed service providers and software vendors should expect stricter clauses, drill participation and evidence requests. Our Third-Party Risk Management Guide covers how to answer and set these.
• Product restrictions: if your product or a component could be treated as a risky product, government and government-linked customers may need approval to use it. Track MODA's lists.
• Shared credentials across borders: remote support, file transfer and engineering collaboration often run on shared service accounts and long-lived keys between companies. A compromise of those credentials can trigger CSMA reporting at the customer and PDPA breach duties at both ends.

What it means for non-human identities and AI agents

Neither law names machine identities, but both depend on knowing which identity did what. Our recommendations:

• Inventory: list service accounts, API keys, OAuth grants and AI agents that can reach personal data files or covered systems, each with a named owner. See NHI Inventory Reconciliation.
• Supplier access: give each contractor its own scoped, time-limited credentials and record them in the contract, so CSMA contract duties and forensic requests can be met.
• Rotation and revocation: rotate or replace long-lived secrets and revoke them when a contract ends; see Credential Rotation at Scale.
• Evidence: keep attributable logs so Article 12 records and a third-party forensic report can show which identity accessed what.
• AI agents: give each agent its own identity tied to a human owner, with least-privilege access to personal data; a leaked agent token is a breach path like any other.

Compliance steps

1. Confirm whether you are a CSMA-specific non-government agency or a supplier to one, and which sector regulator supervises you under the PDPA transition.
2. Check the effective dates and any PDPC or MODA regulations issued since this guide was written.
3. Update the incident response plan with a PDPA regulator-reporting decision step and CSMA reporting, and pre-draft individual notices.
4. Set up an Article 12 incident record template covering facts, impact and remedial measures.
5. Map current personal data security controls against your sector's existing security and maintenance rules, ready for the PDPC baseline.
6. For CSMA entities, appoint the security officer and staff, and review contractor contracts and certifications.
7. Inventory and scope machine identities and supplier credentials.

Common failure patterns

• Waiting for the effective date before preparing, when regulations may follow with short lead times.
• Breach plans that only cover notifying individuals and miss the new regulator report.
• Supplier access through shared accounts, which defeats forensic attribution.
• No record of remedial measures, so Article 12 evidence has to be rebuilt after an incident.

Practitioner checklist

• CSMA status and PDPA supervising regulator confirmed and recorded.
• Effective dates and new regulations checked each quarter.
• Incident plan covers individual notice, PDPC reporting and CSMA reporting.
• Article 12 incident record template in use.
• Contractor contracts include security terms, certifications and drill cooperation where CSMA applies.
• Service accounts, keys and AI agents inventoried, owned, scoped and rotated.
• Logs attributable to individual identities and kept long enough to support an investigation.

Standards and references

• K&L Gates: New Developments in the Taiwan Personal Data Protection Act (13 January 2026)
• Jones Day: Taiwan Passes Major Amendments to the Personal Data Protection Act
• Baker McKenzie: Taiwan, Amendment to Personal Data Protection Act
• Baker McKenzie: Taiwan, Amendment to Cybersecurity Management Act
• Lee and Li: Amendment to the Cyber Security Management Act
• Asia Pacific Law Japan: Taiwan newsletter (March 2026)
• Taipei City Government Laws and Regulations Database: Cyber Security Management Act, amendment history
• Legal 500: Taiwan, Data Protection and Cybersecurity comparative guide

Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Breach Notification Laws by Country Guide · Third-Party Risk Management Guide · Incident Response Plan Template. This guide summarises Taiwan's PDPA and CSMA amendments as at November 2026 and is not legal advice.