December 2025
Taiwan MOHW Announces Restrictions on Cross-Border Transfer of Personal Data to Mainland China, Hong Kong, and Macau by Western Pharmaceutical Wholesalers and Retailers
Pursuant to Article 21, Paragraph 3 of the Personal Data Protection Act (hereinafter, the “PDPA”), where a non-government agency transfers personal data internationally and the recipient jurisdiction lacks sound personal data protection laws or regulations such that the rights and interests of data subjects may be jeopardized, the competent authority may impose restrictions on such transfers. Based on this statutory authorization, Taiwan’s Ministry of Health and Welfare (hereinafter, the “MOHW”) issued, on September 30, 2025, an announcement imposing restrictions on cross-border transfers of personal data by western pharmaceutical wholesalers and retailers (see MOHW Letter No. Wei-Shou-Shi-Zi-1149037011, hereinafter the “Announcement”). As of the effective date of the Announcement, western pharmaceutical wholesalers and retailers are, in principle, prohibited from transferring personal data to Mainland China, Hong Kong, and Macau.
The scope of restricted cross-border transfers includes, among others, situations where members of the public contact branches or outsourced service providers located in Mainland China, Hong Kong, or Macau and provide personal data; where businesses transfer personal data in their possession to branches or outsourced service providers in those regions; or where data are uploaded to servers located in Mainland China, Hong Kong, or Macau. [1]
The Announcement does not impose a blanket prohibition on all transfers of personal data to Mainland China, Hong Kong, or Macau. The following circumstances fall outside the scope of the restrictions (see Item 1 of the Announcement):
1. Personal data that cannot be used, directly or indirectly, to identify a specific individual;
2. Personal data not obtained in the course of conducting pharmaceutical-related business;
3. Personal data of employees of western pharmaceutical wholesalers or retailers, or personal data obtained by such businesses in the course of performing their operations from recruitment service providers, business partners, or internal business dealings;
4. Where the head office or parent company of a western pharmaceutical wholesaler or retailer is included under the European Union’s General Data Protection Regulation (“GDPR”) adequacy decision, Data Privacy Framework list, or has adopted Binding Corporate Rules, executed EU-approved Standard Data Protection Clauses, adhered to approved Codes of Conduct, or obtained relevant certifications under the GDPR;
5. Transfers necessary for conducting pharmaceutical clinical trials, provided that the relevant matters are disclosed in the informed consent form and the recipient is obligated, by contract or other means, to comply with Taiwan’s PDPA;
6. Transfers involving drug safety reporting or pharmacovigilance, where the required security measures under Article 4 of the Regulations Governing the Implementation of Personal Data File Security Maintenance Plans for Western Medicine Wholesalers and Retailers have been incorporated into the pharmacovigilance plan appendix, and the recipient is obligated, by contract or other means, to comply with Taiwan’s PDPA;
7. Transfers made in response to lawful reporting requirements imposed by the health authorities of Mainland China, Hong Kong, or Macau;
8. Transfers governed by contracts incorporating standard contractual clauses, ensuring that the recipient complies with Taiwan’s PDPA;
9. Transfers based on the data subject’s written authorization;
10. Transfers made with the data subject’s written consent.
The Announcement will be implemented in phases. For western pharmaceutical wholesalers and retailers, as defined under Article 3 of the Regulations for the Security and Maintenance of Personal Information Files in Wholesaling and Retailing Western Pharmaceuticals—namely, businesses duly registered pursuant to Article 27, Paragraph 1 of the Pharmaceutical Affairs Act, with paid-in capital of at least NT$30 million, and that recruit members or are able to obtain personal data of transaction counterparties—the restrictions will take effect on October 1, 2026. For other businesses operating western pharmaceutical wholesale or retail activities, as defined under Article 15, Subparagraph 1 of the Pharmaceutical Affairs Act, the restrictions will take effect on October 1, 2027 (see Item 2 of the Announcement).
Although the Announcement does not take immediate effect and provides for a transitional period, relevant businesses are advised to begin reviewing their existing practices regarding the collection, use, and cross-border transfer of personal data. At the same time, businesses should conduct an inventory of outsourcing arrangements, information systems, and contractual provisions involving Mainland China, Hong Kong, and Macau to assess compliance with the Announcement and Taiwan’s PDPA. Conducting a comprehensive legal assessment and making necessary adjustments at an early stage will help ensure a smooth transition to compliance and mitigate potential operational risks in the future.
[1] MOHW Food and Drug Administration, FAQ on Cross-Border Transfers of Personal Data,https://www.fda.gov.tw/tc/newsContent.aspx?cid=3&id=31222 (last visited: December 22, 2025).
The scope of restricted cross-border transfers includes, among others, situations where members of the public contact branches or outsourced service providers located in Mainland China, Hong Kong, or Macau and provide personal data; where businesses transfer personal data in their possession to branches or outsourced service providers in those regions; or where data are uploaded to servers located in Mainland China, Hong Kong, or Macau. [1]
The Announcement does not impose a blanket prohibition on all transfers of personal data to Mainland China, Hong Kong, or Macau. The following circumstances fall outside the scope of the restrictions (see Item 1 of the Announcement):
1. Personal data that cannot be used, directly or indirectly, to identify a specific individual;
2. Personal data not obtained in the course of conducting pharmaceutical-related business;
3. Personal data of employees of western pharmaceutical wholesalers or retailers, or personal data obtained by such businesses in the course of performing their operations from recruitment service providers, business partners, or internal business dealings;
4. Where the head office or parent company of a western pharmaceutical wholesaler or retailer is included under the European Union’s General Data Protection Regulation (“GDPR”) adequacy decision, Data Privacy Framework list, or has adopted Binding Corporate Rules, executed EU-approved Standard Data Protection Clauses, adhered to approved Codes of Conduct, or obtained relevant certifications under the GDPR;
5. Transfers necessary for conducting pharmaceutical clinical trials, provided that the relevant matters are disclosed in the informed consent form and the recipient is obligated, by contract or other means, to comply with Taiwan’s PDPA;
6. Transfers involving drug safety reporting or pharmacovigilance, where the required security measures under Article 4 of the Regulations Governing the Implementation of Personal Data File Security Maintenance Plans for Western Medicine Wholesalers and Retailers have been incorporated into the pharmacovigilance plan appendix, and the recipient is obligated, by contract or other means, to comply with Taiwan’s PDPA;
7. Transfers made in response to lawful reporting requirements imposed by the health authorities of Mainland China, Hong Kong, or Macau;
8. Transfers governed by contracts incorporating standard contractual clauses, ensuring that the recipient complies with Taiwan’s PDPA;
9. Transfers based on the data subject’s written authorization;
10. Transfers made with the data subject’s written consent.
The Announcement will be implemented in phases. For western pharmaceutical wholesalers and retailers, as defined under Article 3 of the Regulations for the Security and Maintenance of Personal Information Files in Wholesaling and Retailing Western Pharmaceuticals—namely, businesses duly registered pursuant to Article 27, Paragraph 1 of the Pharmaceutical Affairs Act, with paid-in capital of at least NT$30 million, and that recruit members or are able to obtain personal data of transaction counterparties—the restrictions will take effect on October 1, 2026. For other businesses operating western pharmaceutical wholesale or retail activities, as defined under Article 15, Subparagraph 1 of the Pharmaceutical Affairs Act, the restrictions will take effect on October 1, 2027 (see Item 2 of the Announcement).
Although the Announcement does not take immediate effect and provides for a transitional period, relevant businesses are advised to begin reviewing their existing practices regarding the collection, use, and cross-border transfer of personal data. At the same time, businesses should conduct an inventory of outsourcing arrangements, information systems, and contractual provisions involving Mainland China, Hong Kong, and Macau to assess compliance with the Announcement and Taiwan’s PDPA. Conducting a comprehensive legal assessment and making necessary adjustments at an early stage will help ensure a smooth transition to compliance and mitigate potential operational risks in the future.
[1] MOHW Food and Drug Administration, FAQ on Cross-Border Transfers of Personal Data,https://www.fda.gov.tw/tc/newsContent.aspx?cid=3&id=31222 (last visited: December 22, 2025).
