Short answer: When a vendor processes your customers' personal data, Article 4 of Taiwan's Personal Data Protection Act treats it as if you did it yourself, so you remain liable, with fines up to NT$15 million. Grade the risk with a 4-factor score (4–12): at 7 or more, sign a data processing addendum and review every 6 months; at 10 or more, develop on de-identified data and review quarterly.
A 40-person e-commerce company handed 30,000 member records to a vendor for a redesign, and an engineer copied the production database to his own laptop for testing. Six months later the laptop was lost, and the owner discovered the contract had only a one-page confidentiality clause: nothing on where data may be stored, when it must be deleted, or how fast an incident must be reported. Notifying members, investigating and answering the regulator all fell on the company.
Industry myths, busted
Bottom line: you outsource the work, not the responsibility.
- Myth: if the vendor makes the mistake, the vendor is liable. Reality: Article 4 of the Personal Data Protection Act says a commissioned party is "deemed to be the commissioning agency", so you still answer to your customers.
- Myth: an NDA is enough. Reality: Article 8 of the PDPA Enforcement Rules requires the commissioning party to exercise "appropriate supervision", check the vendor periodically and keep records.
- Myth: testing on real data is more accurate. Reality: most development testing works fine on de-identified data; production data should be touched once, at migration.
- Myth: small companies don't get fined. Reality: after the 2023 amendment, failing to maintain adequate security can cost NT$20,000–2 million, and NT$150,000–15 million in serious cases.
Core framework: the Vendor Data Risk Score
Bottom line: score 4 factors from 1 to 3; the total decides how detailed the contract must be and how often you review.
| Factor | 1 point | 2 points | 3 points |
|---|---|---|---|
| Data sensitivity | Name, email | Phone, address, purchase history | Medical records, national ID numbers, financial data |
| Record count | Under 1,000 | 1,000–50,000 | Over 50,000 |
| Vendor access depth | Code only | Test environment data | Can log in to the production database |
| Where data lives | Your cloud account | A shared account | Vendor servers or personal computers |
- 4–6 points: add 1 personal data clause to the contract; review once a year.
- 7–9 points: sign a separate data processing addendum covering each item listed in Article 8 of the Enforcement Rules; review every 6 months.
- 10–12 points: also require de-identified test data, access logs and a vulnerability scan; review every quarter.
Three typical scenarios compared
Bottom line: depending on the data, annual oversight time can differ 8-fold.
| Scenario | Score | Outcome |
|---|---|---|
| 15-person design firm, website contact form, about 300 records a year | 5 | 1 clause + annual review, about 4 internal hours |
| 40-person e-commerce member system redesign, 30,000 records with addresses and orders | 8 | Data processing addendum + reviews every 6 months, about 16 hours a year |
| 25-person aesthetic clinic, bookings and treatment records, 8,000 records | 11 | Medical records are special-category data: de-identified development + quarterly reviews, about 32 hours a year |
The full list of hidden costs
Bottom line: prevention costs are counted in hours, incident costs in hundreds of thousands (figures below are ScriptWalker experience-based estimates).
- Addendum and internal inventory: 8–16 hours, one-off.
- De-identified test data: 16–40 vendor hours, about NT$20,000–50,000.
- Periodic reviews: 4–8 hours each.
- Incident notification: SMS to 30,000 people costs about NT$20,000–30,000, plus 40–80 hours of customer service.
- Investigation and legal advice: NT$100,000–500,000.
- Fines: NT$20,000–15 million.
KPI scorecard for evaluating an outsourcing partner
Bottom line: score each item 0–2; below 14, do not let the vendor touch production data.
- ☐ Asks about data sensitivity and record count unprompted
- ☐ Willing to sign a data processing addendum
- ☐ Develops on de-identified data by default
- ☐ Keeps the production database in your account
- ☐ One account per person, no sharing
- ☐ Can provide access logs
- ☐ Discloses whether work is subcontracted
- ☐ Commits to an incident notification deadline (e.g. 24 hours)
- ☐ Provides proof of deletion at project close
- ☐ Runs a basic vulnerability scan before launch
ScriptWalker's matching options, and when we are not the right fit
Bottom line: by default, we do not take production data out of your environment.
How ScriptWalker (a Taiwan-based Laravel/Flutter custom development studio) handles this: project-based work (systems from NT$80,000) comes with a data processing addendum template; monthly maintenance (from NT$2,000/month) includes a permission review every 6 months; and our advisory mode can help you review other vendors' addenda.
We are not the right fit if:
- You want the production database copied straight to engineers for development.
- You are unwilling to sign any personal data clause.
- Your tender requires ISO 27001 or similar certification: choose a certified vendor.
90-day playbook
Bottom line: set the score and sign the addendum in month 1; run and record the first review on day 90.
- Month 1: inventory data fields and record counts, calculate the score, sign the addendum, set up one account per person.
- Months 2–3: switch to de-identified data and turn on access logs.
- Day 90: check each addendum item and record the results in writing.
Decision checklist
- ☐ I know which personal data fields the vendor will touch
- ☐ The risk score is calculated
- ☐ The contract has a personal data clause or addendum
- ☐ It states where data is stored
- ☐ It states the incident notification deadline
- ☐ It states whether subcontracting is allowed
- ☐ Development uses de-identified data
- ☐ The production database sits in our own account
- ☐ Proof of deletion is required at close
- ☐ Review dates are on the calendar
If you can't tick at least 7, don't hand over the data yet.
FAQ
If a vendor leaks personal data, is the client company liable?
Yes. PDPA Article 4 treats the vendor as you, so you still notify customers and face the regulator.
What must a data processing addendum cover at minimum?
Scope, storage location, subcontracting, incident notification, return and deletion at close, and periodic reviews.
Is development on production data never allowed?
Not absolutely, but de-identified data is enough for most testing.
How often should I review the vendor?
By risk score: 4–6 yearly, 7–9 every 6 months, 10 or more quarterly.
Call to action
Send us your outsourcing contract and the data fields you plan to share, and we will calculate your Vendor Data Risk Score in a free 30-minute session:
- Email: [email protected]
- Phone: 0916-224-047
- LINE: @ufv9089p