Newsletter
MOHW announces restrictions on cross-border transfer of personal data to China, Hong Kong and Macao by Drug Wholesalers and Retailers
MOHW announces restrictions on cross-border transfer of personal data to China, Hong Kong and Macao by Drug Wholesalers and Retailers
Ken-Ying Tseng/ Katherine Chuang/ Roger Kai
The Taiwan Personal Data Protection Act (“PDPA”) generally permits cross-border transfers of personal data. Nonetheless, Article 21 of the PDPA authorizes industry regulators to restrict cross-border transfers of personal data under certain circumstances. On September 30, 2025, the Ministry of Health and Welfare (“MOHW”) proposed a draft ruling prohibiting drug wholesalers and retailers from transferring personal data to China, Hong Kong and Macao due to the inadequacy of their personal data protection laws, except under any of the following circumstances:
1. The data subject cannot be identified directly or indirectly by the personal data.
2. The personal data is not obtained for conducting pharmaceutical business.
3. The data subject is an employee of the drug wholesaler /retailer, or the drug wholesaler/retailer obtained the personal data while dealing with its service providers/business partners or handling intra-company affairs.
4. The drug wholesaler’s/retailer’s headquarters or parent company is included in the List of Data Privacy Frameworks recognized under the EU General Data Protection Regulation (“GDPR”) Adequacy Decisions, has in place binding corporate rules, standard data protection clauses, or codes of conduct, or has obtained specific certification in accordance with the GDPR.
5. The drug wholesaler/retailer collected or processed the personal data while performing clinical trials, or the personal data was obtained by the drug wholesaler/retailer for clinical trials of Taiwan-developed products and transferred to institutions in China, Hong Kong and Macao for them to collect, process, or use for performing clinical trials, and in compliance with the relevant regulations.
6. The drug wholesaler/retailer collected or processed the personal data for drug safety reporting, or the personal data was obtained by the drug wholesaler/retailer for drug safety surveillance requirements in Taiwan and transferred to institutions in China, Hong Kong and Macao for them to collect, process, or use for drug safety surveillance, and in compliance with the relevant regulations.
7. The personal data was collected or processed by the drug wholesaler/retailer to report to health authorities in China, Hong Kong and Macao as required by such authorities or according to drug-administration laws or regulations in China, Hong Kong and Macao.
8. The drug wholesaler/retailer has mandated institutions in China, Hong Kong and Macao to comply with the PDPA and other relevant regulations through standard contractual clauses.
9. The data subject has commissioned the drug wholesaler/retailer in writing to do so.
10. The drug wholesaler/retailer has obtained the written consent of the data subject.
Effective October 1, 2026, the restrictions will apply to drug wholesaler/retailer as defined in the “Regulations for the Security and the Maintenance of Personal Information Files in Wholesaling and Retailing Western Pharmaceuticals”. Starting from October 1, 2027, the restrictions will be extended to other drug wholesalers/retailers.
The aforementioned restrictions contain detailed provisions for the related matters. Our firm’s “Digital, TMT, and Data Privacy Practice Group” and “Life Sciences & Healthcare Practice Group” have extensive experience in assisting companies with the prevention and response to data protection, medical and pharmaceutical matters. Should you require any assistance, please do not hesitate to contact our team of experts.