A Taiwan business must answer your inquiry, let you review the personal data it has collected about you, or provide a copy when you request it, subject to the exceptions in Article 10 of the Personal Data Protection Act. Article 3 protects these rights against advance waiver or contractual restriction.
Personal data includes information that identifies you directly or indirectly. Your name, contact details and financial information are among the examples in Article 2. Membership and transaction records can fall within that definition when they identify you. The request concerns your own personal data; it does not create a general right to inspect all of the business's documents.
Identify the account and the information you want
Use the business name shown in your contract or privacy notice, and find its established channel for privacy requests. If a service has several brands or branches, identify the one you used. Ask which entity handles the request if that is unclear.
For an ordinary membership or customer account, the following details can make your request easier to locate. They are practical suggestions, not a government application form.
| Detail | What to specify |
|---|---|
| Your relationship with the business | The service or branch, membership or customer number, and the contact detail already associated with the account. |
| The data requested | For example, your membership profile, contact information held against the account, and transaction records that identify you. |
| Relevant dates | The period covered by the request, particularly if the account has been closed or your contact details changed. |
| The response you want | Whether you want to inspect the data or receive a copy, and your preferred way to receive the response. |
Say expressly that you are requesting access to, or a copy of, your personal data under Taiwan's Personal Data Protection Act. If you need a copy, make that clear instead of asking only which kinds of information the business keeps. The Chinese terms 查詢、閱覽 and 製給複製本 correspond to inquiry, review and provision of a copy in Article 10.
Use the business's established contact to ask what identification it needs and how to provide it securely before attaching an identity-document scan. Keep passwords and payment verification codes out of the request.
Fifteen days for the decision
Under Article 13, the business must decide whether to approve or reject an Article 10 request within 15 days of receiving it. If an extension is necessary, it may extend that period by no more than 15 days and must notify you of the reason in writing.
That is a deadline for the decision on the request. It is not a promise that every copy will have been delivered by day 15. An acknowledgement or reference number can help establish receipt, but does not itself tell you whether the request was approved or rejected. Keep the submitted request and the acknowledgement, including their dates.
If the business approves the request, ask when and how access or delivery will be arranged. Article 14 permits a charge for necessary costs of answering an inquiry, allowing review or providing a copy. Ask what any proposed charge covers and how it is calculated. If you prefer an electronic copy, ask whether that format is available and what it would cost.
Read a refusal against the statutory exceptions
Article 10 provides exceptions where responding would:
- harm national security, diplomatic or military secrets, overall economic interests or other major national interests;
- interfere with a government agency's performance of its statutory duties; or
- harm the major interests of the collecting organisation or a third party.
If the business refuses all or part of your request, ask which exception it relies on and which data it has withheld. Where a record also concerns someone else, ask whether your information can be provided separately. Whether that is possible depends on the record and the applicable exception; the request does not entitle you to unrestricted access to other people's information.
Compare any material supplied with the categories and period you originally requested. For example, a reply containing your current contact details may leave your request for historical details unanswered. Ask whether the business holds those earlier details and is withholding them, or whether it holds no such data. Those are different explanations, and the follow-up should identify which one still needs an answer.
Official sources
- Personal Data Protection Act: Article 2, definitions; Article 3, individual rights.
- Article 10, inquiry, access and copies with exceptions.
- Article 13, decision periods and extensions; Article 14, necessary costs.
Sources checked on 3 October 2026.
This article provides general information and is not legal advice on any individual matter.
