Self-certification is allowed in the country for radio transmission, electromagnetic interference (EMI) or electromagnetic compatibility (EMC). Taiwan allows foreign companies to self-certify that they comply with these standards, through a Supplier Declaration of Conformity (SDoC). The supplier or manufacturer of the equipment declares the equipment meets the technical and administrative requirements on the basis of test reports by a testing laboratory recognized by the regulator. No registration of the equipment with the regulator is required.

The de minimis threshold, which is the minimum value of goods below which customs authorities do not impose duties, is set at USD 60. This level is below the USD 200 threshold recommended by the International Chamber of Commerce (ICC). Art. 11 of the "Regulations Governing Customs Clearance Procedures for Air Express Consignments" specifies that imported express consignments shall be classified according to their nature and value, with each category processed under the corresponding procedures. Low‑value, duty‑free import consignments are defined as those with a customs value not exceeding TWD 2,000 (approx. USD 60)

According to Art. 29 of the Fraud Crime Hazard Prevention Act of Taiwan, online advertising platform operators that provide services within Taiwan but do not maintain a physical presence, residence, or established branch in the territory are legally required to appoint a legal representative located in Taiwan. This representative must be either a Taiwanese national, a legally registered corporation, or a non-corporate entity with a representative or manager domiciled in Taiwan. The operator must report the full contact details of the appointed representative to the competent authority responsible for industries related to the digital economy. The representative must be authorised to receive legal documents, assist in compliance with fraud prevention regulations, and carry out other statutory duties.
Under Art. 2.5, the term "online advertising platform operators" refers to final-stage platform operators that provide services for posting or disseminating advertisements, collect remuneration, and engage with citizens through online platforms or spaces. It is reported that this provision applies to both domestic and foreign internet platforms, including those related to social media, search engines, news, education or knowledge, dating, video, or similar services, provided they present, post, or deliver advertisements within Taiwan in quantities that meet the thresholds set by the Ministry of Digital Affairs (MoDA). At present, MoDA has designated Google, YouTube, Line, Facebook, Instagram and TikTok as regulated internet platforms. The companies operating these platforms are therefore required to comply with the legal representative appointment requirement in Taiwan.
It is reported that, invoking Art. 42, Taiwan’s Ministry of the Interior imposed a one‑year prohibition on Xiaohongshu (Rednote), a Chinese social media platform, on 4 December 2025. According to the government, the platform’s lack of cooperation, including its refusal to establish a local representative office, left the authorities with no viable option other than comprehensive blocking.

The Fair Trading Act, the Consumer Protection Act, and the Electronic Signatures Act provide a comprehensive consumer protection framework that also applies to online transactions. The former aims to ensure free and fair competition and promote economic stability and prosperity. In addition, the Consumer Protection Law has been enacted for distance selling and information marketing. In addition, the Electronic Signatures Law facilitates secure electronic transactions by recognising the validity of electronic records.

Pursuant to Art. 8 of the Regulations on the Preparation and Management of Electronic Medical Records by Medical Institutions, when a medical institution utilises cloud services to collect, process, and use electronic medical records, the data storage location of the cloud service should, in principle, be situated in Taiwan.

Art. 44 of the Rules Governing the Administration of Electronic Payment Business, as amended in July 2021, stipulates that the information system and security management operations of an electronic payment institution must be established within the territory of Taiwan. However, this requirement does not apply where the institution satisfies specific conditions and obtains approval from the competent authority. These conditions include ensuring that the competent authority can access relevant information immediately, directly, completely, and continuously. To obtain such approval, the institution must submit documentation, including a confirmation letter from the local government authority where the offshore service provider is located, an inspection report from an independent IT auditor, a contingency plan with a supporting assessment, a supervision plan detailing oversight mechanisms, and a cost-benefit evaluation approved by the board of directors. In addition, the institution must not have been sanctioned for financial regulatory violations in the preceding year, must have addressed any deficiencies identified by regulators, and must not have any unresolved major information security breaches.
Prior to the 2021 amendment, the Rules contained a similar provision in Art. 23, which required that the information system and its backup system for the electronic payment business of specialised electronic payment institutions be established within the territory of Taiwan.

Art. 17 of the "Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation" obliges financial institutions outsourcing to overseas service providers to ensure that customer data is used strictly within the scope of the outsourced operations, kept separate from the data of the service provider and other institutions, and is accessible to the competent authority. Art. 18 mandates prior approval for outsourcing “material” retail financial business information systems abroad, requiring detailed documentation on data protection, risk management, and audit mechanisms. The term “material” refers to outsourced operations that, if disrupted or compromised, could significantly affect the financial institution’s operations or customer interests. Art. 19, which specifically addresses cloud-based services, stipulates that customer data from material retail financial systems shall, in principle, be stored within the territory of Taiwan, and if stored offshore, backups of important customer data must be retained domestically unless otherwise approved by the competent authority.

Taiwan has not joined any agreement with binding commitments to open transfers of data across borders.

The Personal Data Protection Act (PDPA) establishes a comprehensive framework for data protection in Taiwan. Initially introduced in 1995, the Act underwent significant amendments in 2010, with the revised version coming into force in 2012. The Enforcement Rules of the Personal Data Protection Act provide further guidelines for the interpretation and implementation of the Act. The enforcement of the PDPA is carried out by ministries, commissions, and local governments. As mandated by the Constitutional Court's 111-Shien-Pan-13 judgement, the Legislative Yuan passed amendments to the Act in May 2023 to establish an independent supervisory mechanism for data protection. Article 1-1 of the amended PDPA specifies that the Personal Data Protection Commission (PDPC) will serve as the competent authority for the Act, consolidating enforcement powers previously dispersed among ministries, commissions, and local governments. The Preparatory Office of the PDPC was established in December 2023, assuming responsibility for interpreting the Act from the National Development Council as of January 2024.

Art. 9 of the Telecommunications Management Act requires telecom enterprises to retain communications records such as the numbers of the sender and the recipient, time of communication, address, service type, mailbox or location information. The "Regulations on Users of Telecommunications Businesses Inquiring Communication and Account Records" were established in accordance with the stipulations of Art. 9 of the Telecommunications Management Act. Under Art. 4 of the Regulations, telecommunications enterprises must retain communication records and accounting records for at least one year.

For law enforcement agencies to access the content of communications, they need either interception warrants or access warrants approved by a court. However, in urgent situations or for specific crimes, Art. 11.1 of the Communications Security and Surveillance Act provides that the agencies may access the communications without a warrant as long as they obtain it within 24 hours after the surveillance. It is reported that the lack of judicial review over surveillance requests has been increasingly normalised. More generally, it is reported that government units with certain investigative powers have gone directly to state agencies and private companies to request personal data without first receiving a court order or other oversight. For example, the Ministry of Economic Affairs, between 2017 and 2018, had a 100% success rate in receiving information from the 1,112 requests it filed for personal information. Of these, 1,000 requests were to non-government agencies, including Chunghwa Telecom, Taiwan Mobile CO., and Yahoo! Taiwan Holdings Limited. Between 2015 and 2016, the Ministry of Finance submitted 350 requests with a 99.4% success rate. The Criminal Investigation Bureau also reportedly issued 565 requests to Facebook through this process, with a 52.9% success rate, between 2015 and 2016.

The Copyright Act, as amended in 2009 with the introduction of Arts. 90-4 to 90-12, establishes a safe harbour regime for intermediaries for copyright infringements. They largely follow the framework of the US Digital Millennium Copyright Act (DMCA). Internet service providers are divided into four categories with different conditions of eligibility of limitation on liability: connection service providers, caching service providers, information storage service providers, and search service providers.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Taiwan's law and jurisprudence.

Under the "Second Category of Telecommunications Business Management Rules" promulgated in August 2014, and pursuant to Art. 17 of the Telecommunications Management Act, the country has implemented mandatory SIM card registration requirements. In 2017, the National Communications Commission also stated that, when applying for a house number or prepaid card, people should apply for dual certificates, and telecommunications businesses should verify and login user information.

In August 2020, the Ministry of Economics, through an amendment to Art. 35 of the Act Governing Relations between the People of the Taiwan Area and the Mainland Area, announced that Taiwanese companies would be prohibited from providing video streaming services originating from Chinese companies or individuals, specifically targeting iQIYI and Tencent, starting from September 2020. The regulation formally banned Taiwanese companies and individuals from acting as agents or distributors for any Chinese over-the-top (OTT) services, including television or other broadcast platforms, such as the digital television channel service Media on Demand.