A breach notice from a company abroad: what Taiwan's data law gives an American living in Taipei

Two years. That is how long a claim under Taiwan's Personal Data Protection Act (個人資料保護法) lasts once the victim knows of the harm and who owes for it, with an outer limit of five years from the harm itself (Article 30). A breach notice in the inbox is the sort of document a company will later point to as the day you knew.

Whether the clock matters depends on a prior question. Does Taiwan's law reach the company at all?

Who the Act protects, and where

Start with the definition. The data subject is simply the person the data is about (Article 2(9)), and nothing in the Act asks for a passport when the collection or processing happened in Taiwan. Nationality enters only when the Act reaches outward. Article 51(2) applies it to government and non-government agencies that collect, process or use the personal data of ROC nationals outside ROC territory.

A US citizen's data that a US company collected in the United States and keeps on US servers sits outside that sentence, so Article 51(2) gives no claim there, and what a claim at home would look like is a question for US counsel.

Collection in Taiwan is the easier case: a car-rental company that took your details at a Taipei counter, say. Harder is the US brokerage app you kept using after moving to Da'an, run by a US company on servers in the United States (an invented example). Where the data was "collected" can itself become the dispute. We found no published official interpretation that settles it.

One courthouse, then a choice-of-law question

For damages suits brought under the Act against a private company, Article 33 gives exclusive jurisdiction to the district court where the company has its principal office or place of business. A foreign company with neither in Taiwan is sued in the district court where the central government sits, which means Taipei. Winning there is only part of the job when the company keeps nothing in Taiwan: the judgment would still have to be enforced where the company is.

Which law decides the claim is a separate step. Article 25 of the Act Governing the Choice of Law in Civil Matters Involving Foreign Elements (涉外民事法律適用法) points to the law of the place of the tort, unless another law is more closely connected. Article 28 has separate rules for torts committed through publication, broadcasting or computer networks, and whether a hacked database fits that description is arguable.

What a leak is worth on paper

NT$500 to NT$20,000. That is the per-person, per-incident range a court may be asked to use when actual loss is hard or impossible to prove, depending on how serious the infringement was (Article 28(3)). Article 28 is written for government agencies. Paragraph 2 of Article 29 applies its paragraphs 2 to 6 to private companies, so non-pecuniary harm can also be compensated with a reasonable sum.

Liability itself comes from Article 29(1): a private company whose violation of the Act leads to unlawful collection, processing or use of personal data, or other infringement of the data subject's rights, must pay. It escapes only by proving it was not at fault. The burden sits with the company.

Large incidents have a ceiling. One incident affecting many people is capped at NT$200 million in total, unless the interests involved in that incident exceed NT$200 million, in which case that amount is the cap. Once the total passes the cap, the NT$500 floor falls away.

Group cases are opt-in

No one is added to a Taiwan group case by default. Article 34 lets a foundation or public-interest association sue in its own name after at least 20 victims of the same incident grant it, in writing, the right to litigate; a grant can be withdrawn in writing before oral argument ends. The court may publish notice so that others can join within a set period, and the part of the claim above NT$600,000 is temporarily exempt from court fees.

The Consumer Protection Act (消費者保護法) runs a parallel route by assignment rather than by grant. Under Article 50, a consumer protection group takes over the damages claims of at least 20 consumers and sues; it may not charge them a fee, and a consumer can end the assignment before oral argument closes. The group must have been licensed for two years, employ consumer protection staff, hold an Executive Yuan rating of excellent, and act through a lawyer (Article 49). One limit applies only when a data-law claim takes the assignment route: under Article 28(6) of the data Act, applied to private companies by Article 29(2), a claim for non-pecuniary harm cannot be assigned unless payment of a sum has been agreed by contract or suit has already been filed, so how much of a data-law claim can be handed to a consumer group is a separate question.

For the data Act route, Article 32 limits who can sue: it requires a foundation with registered assets of at least NT$10 million or an association with at least 100 members, data protection within its charter, and at least three years since it was licensed.

What the notice should contain under the rules in force

Taiwan amended the Act on November 11, 2025, rewriting the breach notification article, but the history page records that the Executive Yuan is to set the effective date, and none had been set as of the checking date. The amended Article 12 is therefore not yet the operative text.

What still governs is the earlier Article 12. It requires a government agency or a private business whose violation of the Act led to data being stolen, leaked or altered to investigate and notify the data subject by appropriate means. Article 22 of the Enforcement Rules adds that the notice must state the facts of the infringement and the measures already taken; if individual notice would cost too much, public notice online or through the media may substitute.

The second wave

A leaked card number goes first to whoever issued the card. For a US card, that is your US bank. If a Taiwan-issued card shows charges you did not make and you dispute them with the bank, the Financial Consumer Protection Act (金融消費者保護法), Article 13, sets the next steps: a complaint to the bank, which must handle it and reply within 30 days, then, if you reject the result or no reply comes, 60 days from the result or the missed deadline to apply for review by the dispute resolution body.

Calls and texts from people posing as your bank or the booking site, asking for a transfer or a one-time code, can be checked and reported through the National Police Agency's 165 anti-fraud website and the 165 hotline.

Anyone with loans or cards in Taiwan can order a personal credit report from the Joint Credit Information Center (財團法人金融聯合徵信中心), Taiwan's interbank credit bureau, to look for accounts or inquiries they do not recognize. Foreign residents who have a Taiwan Uniform ID Number (統一證號) apply with one valid original from each of two groups: an ARC, Gold Card or the immigration agency's record of that number (統一證號基資表), plus a passport, National Health Insurance card or Taiwan driver's license (counter applications). An English-language report costs NT$200 for one copy, plus NT$50 for each extra copy ordered at the same time (fees). The Center also accepts data-subject notes, such as a statement that you will not apply for new loans or credit cards, or an explanation of a dispute over data a bank has reported; lenders see them when reviewing loan, card and account applications, which the Center describes as having only a reminder function (credit data notes).

Working with a Taiwan lawyer

If a group suit is forming in Taiwan, a Taiwan lawyer can review the grant papers before you sign and work alongside your US counsel on any claim at home. The same lawyer can assess whether the Act reaches the company at all (Article 51(2) and where the data was collected), put the notice, booking and payment records and any later fraud attempts into evidence, send a written demand and negotiate, and bring the case in the Taipei District Court. For the company-side duties, see A Breach at Your Taiwan Operation; for obtaining a copy of your data from a Taiwan business, Asking a Taiwan Business for a Copy of Your Personal Data. Hovering International Law Firm (昊鼎國際法律事務所) has an English-speaking lawyer in Taipei; write to wei@hoveringlaw.com.tw, or see our dispute services. Taipei office: 7F-2, No. 35, Sec. 1, Chengde Rd., Datong Dist., Taipei City 103 (臺北市大同區承德路一段35號7樓之2).

Two years may run from the day the notice arrived. Five years from the harm is the outer edge, whatever the notice says.

Sources

Checked October 27, 2026.

• Personal Data Protection Act (個人資料保護法): Article 2, Article 28, Article 29, Article 30, Article 32, Article 33, Article 34, Article 51, amended Article 12 (effective date not set)
• Personal Data Protection Act, version in force (amended May 31, 2023); legislative history
• Enforcement Rules of the Personal Data Protection Act, Article 22
• Consumer Protection Act: Article 49, Article 50
• Financial Consumer Protection Act, Article 13
• Act Governing the Choice of Law in Civil Matters Involving Foreign Elements: Article 25, Article 28
• National Police Agency, 165 anti-fraud website
• Joint Credit Information Center, counter applications (親臨或委託親友至聯徵中心櫃台辦理)
• Joint Credit Information Center, post office applications and fees (郵局代收辦理)
• Joint Credit Information Center, credit data notes (信用資料註記)