GDPR and ISO 27701 for the CEO: penalties, cross-border transfers and ownership

We have no establishment in Europe. Does the GDPR reach us? What should the CEO confirm first?

A Taiwanese company without an EU establishment is subject to the GDPR in only two cases (Article 3(2)): offering goods or services to people in the EU, or monitoring their behaviour in the EU.

The CEO should have business and legal teams confirm three things:

1. Which businesses fall under Article 3(2): for example EU e-commerce or member systems for European customers.
2. The role in each business line: controller, joint controller or processor, each with different obligations (Articles 24, 26 and 28); getting this wrong means redoing the documents and contracts.
3. Whether an EU representative is required (Article 27).

Have the conclusions confirmed by legal counsel familiar with the GDPR.

How large are GDPR fines and damages? How do authorities set the amount?

Fines: up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The European Commission explains that authorities consider the nature, gravity and duration of the infringement, whether it was intentional or negligent, any action taken to mitigate the damage to individuals, and the level of cooperation.

Damages: individuals can claim compensation for damage caused by a GDPR infringement, but the Court of Justice ruled on 4 May 2023 that a mere infringement does not by itself give rise to a right to compensation; the individual must prove actual damage, while non-material damage does not have to reach a threshold of seriousness.

What the CEO can do: make sure mitigation and cooperation can be proven from records. Whether a provision should be recognised or a contingent liability disclosed is for the statutory auditor and legal counsel to judge case by case.

Our European subsidiary sends employee data to the HR system at our Taiwan head office. Is that a cross-border transfer?

Usually yes. The European Data Protection Board's Guidelines 05/2021 say a Chapter V "transfer" meets three cumulative criteria: the exporter is subject to the GDPR for the processing; the exporter transmits or makes the data available to another controller or processor; and the importer is in a third country. Companies in the same group can be separate controllers or processors, and disclosures within a group can be transfers; Example 9 in the guidelines is an EU subsidiary sharing data with its parent in a third country.

Taiwan currently has no EU adequacy decision, so a safeguard must be chosen:

Which one to use is for legal counsel to decide based on the group structure.

When personal data leaks, who decides whether to report within 72 hours? What is the CEO's role?

Under GDPR Article 33, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk. A company with no EU establishment has no one-stop shop and may have to notify authorities in several Member States.

The CEO should decide in advance:

• Who decides whether to report: who holds the authority, and who stands in at night and on holidays
• Who sends it: who approves the notification and the message to affected individuals
• Drills: the 72-hour notification must work in practice, with drill records kept

The European Commission's Digital Omnibus proposal of 19 November 2025 would extend the deadline to 96 hours and raise the reporting threshold; it is still in the legislative process, so 72 hours still applies.

Is ISO 27701 worth the investment? How does it help with customers and the ESG evaluation?

ISO/IEC 27701:2025 was published on 14 October 2025, and a privacy information management system (PIMS) can now be built and certified without ISO 27001. Its value is turning GDPR obligations into an auditable management system, so customer audits and questionnaires can be answered with evidence.

The limit of the certificate: ISO 27701 certification is not legal compliance with the GDPR; an Article 27 EU representative, the choice of SCC module and whether a DPIA is mandatory are legal judgments 27701 does not make.

For listed companies, TWSE ESG evaluation item S-13 asks whether the company has a personal data protection policy and discloses its content and implementation. The ESG evaluation covers listed companies; non-public companies are not bound by it but can follow it voluntarily.

Timelines listed on the service pages: basic GDPR compliance usually 2–3 months; with ISO 27701 certification 5–8 months, or 3–5 months with 27001 in place.

Do we need two separate systems for the GDPR and Taiwan's Personal Data Protection Act?

No. With an ISO 27701 privacy information management system as the framework, one system can cover both the GDPR and Taiwan's PDPA:

• Records of processing: built under GDPR Article 30, also covering collection, processing and use under the Taiwanese PDPA.
• Specific purpose and legal basis: Articles 19 and 20 of the Taiwanese PDPA require a specific purpose and legal basis for collection, processing and use, which can be recorded in the same inventory as the GDPR legal basis.
• Breach reporting: one response procedure listing the GDPR 72 hours alongside other applicable reporting requirements.

Note: for the partial amendments to Taiwan's Personal Data Protection Act promulgated on 11 November 2025, the effective date is to be set by the Executive Yuan; until then they should not be planned as obligations already in force.

How does Winners Consulting help the CEO handle the GDPR and ISO 27701?

VP- and director-level consultants lead the work end to end, never outsourced.

• Scope and roles: inventory personal data types, sources, purposes, retention and recipients, and determine GDPR scope and controller or processor roles.
• One system: ISO 27701 as the backbone, with each GDPR obligation mapped to a control, also covering Taiwan's PDPA.
• Cross-border transfers: help review standard contractual clauses, assess transfer impact and keep transfer records.
• 72-hour reporting: breach notification drills and an annual review.
• Named clients: personal data protection clients published with authorisation include the Joint Credit Information Center (JCIC), Lativ, 卓元科健 (Cho Yuan) and Hypercore Fitness Center (full Hypercore case).

Read more: GDPR consulting, ISO 27701 implementation, Choosing a GDPR consultant, ISO 27701 budget.

Request a free mechanism diagnosis