Data Privacy Comparative Guide

1 Legal and enforcement framework

1.1 Which legislative and regulatory provisions govern data privacy in your jurisdiction?

In Taiwan, personal data protection is governed by:

• the Personal Data Protection Act (PDPA);
• the Enforcement Rules of the PDPA; and
• other relevant regulations and rulings issued by the competent authority and the sectoral regulators.

1.2 Do any special regimes apply in specific sectors (eg, banking, insurance, telecommunications, healthcare, advertising) or to specific data types (eg, biometric data)?

Under the PDPA, each sectoral regulator is empowered to interpret PDPA-related matters governing the industry that it regulates, and to stipulate sectoral rules and regulations. The financial and healthcare industries are subject to special rules promulgated by their regulators. Biometric data is regulated as personal data and some types of biometric data (eg, data pertaining to a natural person's genetics) are deemed ‘sensitive personal data'