What can the Taiwan HR team tell employees while the US security team is still determining what happened on a shared network? A company needs facts that its local staff can use: which records were affected, what has been established about the intrusion, and what response measures have already been taken. That information supports the assessment of whether notice is legally required and, if so, what it must say.
An employee notice needs confirmed content
Names and financial details, along with other information that directly or indirectly identifies a person, fall within Personal Data Protection Act Article 2. An incident involving a Taiwan employee database therefore calls for more than an account of restored systems. The local assessment needs the affected categories and the evidence of what happened to them.
The currently effective Article 12 requires appropriate notice after clarification where a violation of the Act causes theft, disclosure, alteration or another infringement of personal data. This is a conditional duty. Enforcement Rules Article 22 requires prompt notification by a means through which the person knows or can know, with the infringement and measures already taken included in the notice.
Taiwan colleagues need those findings from the US team. They provide the factual basis for a notice with the required content. An internal incident report can provide the facts, but sending it to headquarters does not deliver notice to an employee or customer. Equally, a conclusion that no data escaped needs technical support; a gap in the investigation should remain visible in the information supplied for legal review.
As checked on October 23, 2026, Article 12's official page marks the relevant November 11, 2025 amendments as awaiting an effective date. They introduce notice upon awareness, regulatory reporting within a specified scope, and immediate response and recordkeeping measures. They are not yet effective duties. A response document should not take its timing rule from that future text.
The records also matter if someone claims damages
Containment and recovery can be documented alongside the safeguards that were operating before the incident. Access permissions, security measures and investigation records help explain both the event and the company's care. They may later be needed for a customer claim, even where the immediate discussion concerns employee notifications.
Under Article 29, a private business is liable when its violation results in unlawful collection, processing, use or another infringement of the affected person's rights, unless it proves absence of intent or negligence. An outside attacker is not itself that proof. A successful intrusion, in turn, does not automatically establish negligence: the relevant conduct and safeguards must be examined.
The damages framework also reaches beyond an easily itemized financial loss. Article 29 applies Article 28(2)–(6). Those provisions address non-economic harm, court assessment where actual damage is difficult to prove, and multiple claimants. It does not incorporate the public-agency liability standard in Article 28(1). The private company's defense must be assessed under the provision that applies to it.
Identifying the entity that deals with the authority
A group incident file may use the same brand for a US parent, a Taiwan subsidiary and a local branch. Before assigning a reporting task, counsel needs to establish which entity holds or processes the affected data and what business it conducts. Server location cannot answer all of that. The subsidiary–branch distinction is relevant alongside the actual handling arrangements.
Personal-data supervision involves the effective Articles 22 and 27. These provisions address central sector authorities and local governments' inspection powers, appropriate security measures, and security-maintenance plans for designated businesses. Sector rules must be checked to identify any applicable regulatory report. Although the amended Article 27 page displays deletion, that deletion is not yet effective. Existing safeguards remain required.
A different classification determines whether the Cyber Security Management Act reporting route applies. Under Article 3, specific non-government agencies include critical infrastructure providers, state-owned enterprises, specified government-related foundations and government-controlled enterprises, organizations or institutions. Foreign ownership alone does not establish that classification. Neither does semiconductor supply-chain work.
For a critical infrastructure provider, the designation record gives a concrete answer. Article 20 provides for designation by the central sector authority, Executive Yuan approval through the competent authority, and written notice to the provider. The Act's competent authority is the Ministry of Digital Affairs under Article 2. For a covered entity, Article 24 requires reporting and response arrangements and incident reporting to its central sector authority.
A one-hour report cannot wait for a group-wide account
For those covered entities, Article 11 of the incident reporting, response and exercise regulations requires a report within one hour after awareness, using the designated method. The awareness time matters. If the designated method cannot be used, the entity must use another appropriate method within that hour, record the reason, and complete the designated submission after the obstacle is removed.
This clock belongs to that defined category. It is not a universal deadline for every foreign business or every personal-data incident. A company outside the category still needs its personal-data and sector assessment; a covered company must account for this reporting obligation while assembling the broader findings. A timetable based solely on headquarters' completed report could miss the relevant awareness time.
Taiwan counsel can review the technical account for notification purposes, determine the entity and applicable sector rules, coordinate local and headquarters responsibilities, and handle regulatory inquiries or damages claims. Consultation with an English-speaking lawyer in Taipei is available at wei@hoveringlaw.com.tw; the firm's business services cover local corporate arrangements. Offices: 7F-2, No. 35, Sec. 1, Chengde Rd., Datong Dist., Taipei; 6F-1, No. 19, Guanqian Rd., North Dist., Taichung (臺中市北區館前路19號6樓之1). The Taiwan response file should show which facts support each notice, who must receive it, and which awareness time governs any report.
Sources
Checked: October 23, 2026
- Personal Data Protection Act (個人資料保護法): Article 2, amended Article 12 and commencement notice, Article 27 deletion and commencement notice, currently applicable Articles 12, 22 and 27, Article 28, Article 29.
- Enforcement Rules of the Personal Data Protection Act: Article 22.
- Cyber Security Management Act (資通安全管理法): Article 2, Article 3, Article 20, Article 24, legislative history: amended Act effective December 1, 2025.
- 資通安全事件通報應變及演練辦法: Article 11.
Frequently Asked Questions
- Must every Taiwan subsidiary report a cyber incident within one hour?
- No. The one-hour rule discussed here applies to specific non-government agencies under the Cyber Security Management Act. A foreign-owned or technology business is not automatically in that category. Personal-data and sector-specific reporting duties need a separate assessment.
- Is the November 2025 Personal Data Protection Act amendment in force?
- The official provisions checked on October 23, 2026 still mark the relevant amendments, including Article 12, as awaiting an effective date. The existing Article 12 and Enforcement Rules Article 22 remain the basis for the notification duty discussed here.
- Does being attacked establish that the company was not negligent?
- No. Under Article 29, a non-government agency that violates the Act and infringes the affected person’s rights faces damages liability unless it proves absence of intent or negligence. An external attacker’s involvement does not by itself prove that defense.
This article provides general information and is not legal advice on any individual matter.
