MOEA Amends "Retail Industry Personal Data File Security Maintenance and Management Regulations" to Strengthen Consumer Data Protection
As retail services continue to evolve and diversify, retailers increasingly collect, process, and utilize consumers’ personal data, thereby bearing greater responsibility for ensuring data security. The Ministry of Economic Affairs (MOEA) stated that, to strengthen businesses’ implementation of personal data protection, it had already enacted the “Retail Industry Personal Data File Security Maintenance and Management Regulations” on August 1, 2023. Relevant businesses have since complied with the regulations by formulating personal data security maintenance plans.
However, considering that retailers specializing in specific product categories also handle and retain a large volume of consumer personal data, the MOEA has expanded the scope of application. In addition to the original “General Merchandise Retail Industry”, all retail businesses with a capital of at least NTD10 million that recruit members or collect customer transaction data will now be subject to these regulations.
On the other hand, businesses regulated by other central competent authorities—such as those operating under special licenses, requiring specific permits, or governed by specialized management laws—are not subject to these regulations. These include Chinese medicine retailers, cosmetics retailers, Western medicine retailers, multi-level marketing businesses, agricultural product vendors, and medical equipment retailers, who must instead comply with the personal data security rules of their respective authorities.
