The PDPA does not apply to the following circumstances:
1. where personal data is being collected, processed, or used by a natural person purely for purposes of personal or household activities; or
2. where audio-visual data is collected, processed, or used in public places or public activities and not connected to other personal data.
The PDPA also applies to the government and the non-government agencies outside the territory of the Republic of China (R.O.C) when they collect, process or use the personal data of R.O.C. nationals.

The duties of the central government authorities in charge of the industries concerned or the special municipality, county (city) governments concerned under Articles 22 through 26 may be delegated to their subordinate agencies, other agencies or public interest groups. The personnel of such agencies or public interest groups shall be obligated to keep confidential all the data they become aware of during the performance of the duties so delegated or commissioned.
The public interest groups referred to in the preceding paragraph shall not receive any data subject's delegation of litigation rights to file a lawsuit for damages in their names in accordance with paragraph 1 of Article 34.

The Ministry of Justice shall, in conjunction with the central government authorities in charge of the industries concerned, set forth the specific purposes and categories of personal data, and provide the same to government and non-government agencies for reference and use.

After the enactment of the amendments to the PDPA on December 15, 2015, if any personal data was furnished before the amendments to the PDPA on May 26, 2010, not by the data subject, the data subject shall be provided with the information required under Article 9 before such personal data is processed or used.
The obligation to inform as prescribed in the preceding paragraph may be given at the time when such personal data is used for the first time after the enactment of the amendments to the PDPA on December 15, 2015.
Any use of personal data without the information provided in accordance with the preceding two paragraphs shall be deemed and punished as a violation of Article 9.

The Enforcement Rules of the PDPA shall be prescribed by the Ministry of Justice.

The enforcement date of the PDPA shall be set by the Executive Yuan.
The deletion of Articles 19 through 22 and Article 43 on May 26, 2010, and the revision of Article 48 under the amendment to the PDPA made on May 16, 2023, shall become effective on the date of promulgation.