Does a company have to appoint a CHRO?

None of the labour, privacy and trade secret laws or listed-company principles cited on this page creates a "CHRO" or "head of HR" title or requires one; the duties fall on the employer or the company, and who carries them out is a matter of company organisation.

How much compensation does a post-employment non-compete require?

The Ministry of Labor explains that under Article 7-3 of the Enforcement Rules of the Labor Standards Act, monthly compensation may not be less than 50% of the worker's average monthly wage at departure, paid either as a lump sum in advance after departure or monthly; the non-compete may last at most two years and may only be agreed for roles with access to or use of trade secrets.

If a new hire brings in and uses a former employer's data, can our company be fined?

It can. Article 13-4 of the Trade Secrets Act also fines the company, and a company that did its best to prevent the offence can invoke the proviso. In a judgment summarised by the Intellectual Property Office, the court weighed reminders of confidentiality duties during recruitment, written undertakings on joining, security audits and training after joining. Whether the proviso applies is for legal counsel to judge.

Is AI used to screen CVs high-risk in the EU?

Annex III, point 4 of the EU AI Act lists AI used for recruitment or selection, to analyse and filter job applications and to evaluate candidates as high-risk, and Annex III systems apply from 2 December 2027; a system that only performs a narrow procedural task and does no profiling can be excluded under Article 6(3), but this must be documented and registered.

Is sending EU subsidiary staff data to our Taiwan headquarters a cross-border transfer?

Usually, yes. EDPB Guidelines 05/2021 explain that companies in the same group can be separate controllers or processors, and an EU subsidiary sharing data with a parent company in a third country can be a transfer; Taiwan has no EU adequacy decision, so you need a safeguard such as standard contractual clauses or binding corporate rules.

What laws and standards is a CHRO accountable for? 8 requirements explained one by one

Q: Which named clients has Winners served in ISO 27701:2025 PIMS & GDPR Privacy Compliance Consulting?

Named clients published with authorisation: Hypercore Fitness Center — ISO 27001 ISMS and ISO 27701 PIMS dual-certification consulting; 卓元科健 (Cho Yuan) — ISO 27001 ISMS and personal data protection consulting; Joint Credit Information Center (JCIC) — Internal control system integrated with ISO 27001 and TPIPAS; Lativ — Personal data protection consulting. Other engagements are anonymised by industry under NDA.

Direct answer: none of the Taiwanese laws or listed-company principles cited on this page creates a statutory "CHRO" or "head of HR" title; on this page the CHRO means the most senior person responsible for HR in the company. Most legal duties fall on "the employer" or "the company", and HR carries them out: a post-employment non-compete must meet the four requirements of Article 9-1 of the Labor Standards Act; recruiters may not ask for private information not needed for employment (Article 5 of the Employment Service Act); collecting employee data and transferring it abroad are governed by the Personal Data Protection Act; when an employee infringes another company's trade secrets, the company must be able to show it did its best to prevent it (Article 13-4 of the Trade Secrets Act); and for listed companies, integrity training, rewards and penalties, whistleblowing and discipline are set out in the Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies. With EU staff, or when AI is used to manage people in the EU, Article 88 GDPR and Annex III of the EU AI Act also apply. A CHRO has three decisions to make: which roles and data need special control, where the evidence from hiring to exit is kept, and who owns training and whistleblowing. Remember: GDPR and the EU AI Act have no standalone certificate, and an ISO certificate is not legal compliance.

The CHRO in corporate governance: duties the rules place on HR

Who	Rule	Key wording	What it means for the CHRO
All employers	Labor Standards Act, Article 9-1; Enforcement Rules, Article 7-3	A post-employment non-compete must meet four requirements, is void if any one is breached, and may last at most two years; monthly compensation may not be less than 50% of the average monthly wage at departure	Sign only for roles with access to trade secrets, and budget the compensation
All employers	Employment Service Act, Article 5(2)(ii); Enforcement Rules, Article 1-1	No requests for private information not needed for employment; requests may not exceed what a specific purpose requires and must have a legitimate and reasonable connection with it	Check every application and background check field against what the job needs
All non-government entities	Personal Data Protection Act, Articles 5 and 21	No use beyond what the specific purpose requires; in listed circumstances the central competent authority may restrict international transfers	Be able to justify how much employee data you use and where it goes
All companies	Trade Secrets Act, Article 13-4	When a company's representative or employee commits the offence in the course of business, the company is also fined; a company that did its best to prevent it can invoke the proviso	Recruitment, onboarding confidentiality agreements and training need records
Listed companies	Ethical Corporate Management Best Practice Principles, Article 22	Regular training and awareness; combine the ethical management policy with performance appraisal and HR policy, with a clear and effective system of rewards and penalties	Integrity belongs in appraisal and discipline
Listed companies	Ethical Corporate Management Best Practice Principles, Articles 23 and 24	Confidentiality of whistleblowers, anonymous reports allowed, protection from improper treatment; clearly set and publish the discipline and appeal system	One process for reports, investigation, discipline and appeal
Companies with EU staff	GDPR, Article 88	Member States may set more specific employment rules by law or collective agreement, with particular regard to transparency, transfers within a group and monitoring systems at the work place	Judge staff data and monitoring at each subsidiary under local rules
Anyone using AI to manage people in the EU	EU AI Act, Annex III point 4, Article 26(7), Article 5(1)(f)	AI for recruitment and selection, promotion and termination, task allocation and performance monitoring is high-risk; employers inform workers' representatives and affected workers before workplace use; workplace emotion recognition is prohibited in principle	Inventory the uses and your role for every AI tool HR uses

The Ethical Corporate Management Best Practice Principles are for listed companies; companies that are not public companies are not covered and can use them voluntarily. Some amendments to the Personal Data Protection Act promulgated on 11 November 2025 (including Article 21) take effect on a date set by the Executive Yuan; until then the current text applies. Whether an agreement is valid or conduct is unlawful is for legal counsel to judge case by case.

TWSE ESG evaluation: the indicators a CHRO should watch

From 2026 the ESG evaluation replaces the corporate governance evaluation and covers listed companies. The 2026 evaluation (the first) has 75 indicators across three dimensions, covers 1 January to 31 December 2026, and its results are published by the end of April 2027; the 2027 indicators were published on 30 October 2026. Apart from S-7, the indicators below have the same wording in both years.

Indicator	Content (summary)	Bonus	Related service
S-13	Adopt and disclose a personal data protection policy and its implementation	—	GDPR, ISO 27701
S-7	A board-approved ethical management policy, a full- or part-time unit, how it is carried out, and a report to the board at least once a year (2027 wording; split into S-7 and S-8 in 2026)	—	ISO 37001
S-9	Detailed disclosure on the company website of the whistleblowing system for internal and external people on illegal (including corruption) and unethical conduct	—	ISO 37001
S-10	An IP management plan linked to operating goals and its implementation, reported to the board at least once a year	One extra point for TIPS, ISO 56001 or a similar standard with third-party certification	Trade secret protection
S-12	Cybersecurity risk management framework, policy, specific programmes and resources (assessed from the annual report)	One extra point for ISO 27001, CNS 27001 or similar with third-party certification	ISO 27001

The indicators do not name HR, but much of the evidence comes from HR: records of processing employee data, integrity training records, records of reports received and handled, and records of confidentiality agreements and exit procedures. Whether a company scores still depends on checking each year's wording item by item. Companies that are not public companies are not evaluated and can use the indicators voluntarily.

The 8 requirements at a glance

Requirement	What it means for the CHRO	Is there a certificate?
GDPR and ISO 27701	EU staff data, cross-border transfers within the group and employee monitoring	ISO 27701 yes; GDPR has no official certificate
Trade secret protection	Onboarding confidentiality agreements, non-competes and the exit process decide whether the company's case holds up in court	The Trade Secrets Act has no certificate
ISO 37001	Integrity training, rewards and penalties and whistleblowing must show operating records	Yes, third-party certification; it does not guarantee bribery will not occur
EU AI Act	AI used for recruitment, performance and task allocation is an Annex III high-risk use in the EU	No standalone certificate; ISO 42001 certification gives no presumption of conformity
AI transformation	Rules and AI literacy for employees using AI	ISO 42001 can be built alongside; certification is not EU AI Act compliance
ISO 27001	People security: security duties at joining, during employment and at exit, which also evidence reasonable confidentiality measures for trade secrets	Yes, third-party certification
ISO 22301	Who takes over when operations are disrupted must be derived from the BIA and tested in exercises	Yes, third-party certification (three-year cycle)
Digital transformation	HR system roll-out, organisational change and the digital skills gap	Per the service page, ISO 27001 security requirements are the baseline

Requirement by requirement: what the CHRO decides, what comes first, how long it takes

Each service has its own page that answers your role’s questions one by one.

How it fits the systems you already have

New requirements should go into HR's existing recruitment, onboarding, employment and exit processes and the annual training plan, not form a second system.

Existing process	What you already have	How the new requirements fold in
Recruitment	Application forms, interviews, background checks	Remove fields for private information not needed for employment; first decide whether recruitment AI is an EU AI Act Annex III use
Onboarding	Employment contract, confidentiality agreement	Combine the NDA, IP ownership, non-compete and security commitments into one onboarding document; sign non-competes only for roles with access to trade secrets
Annual training	Induction and annual training	Put integrity, trade secrets, security, privacy and AI literacy in one annual training plan and keep sign-off records
Exit	Exit formalities, return of equipment	One checklist covers returning devices, disabling access and signing the exit declaration; logs and classification must exist before anyone resigns
Discipline and appeals	Rewards and penalties rules, grievance channels	Add integrity appraisal, whistleblower protection and discipline and appeal under Articles 22 to 24 of the ethical management principles
Ethical management unit	Annual report to the board (Article 17 of the principles)	Add statistics on training, reports and discipline to the same report

The listed-company principles do not cover companies that are not public companies, which can use them voluntarily. For each service, see: GDPR and privacy, ISO 27701 consulting, Trade secret protection programme, ISO 37001, EU AI Act consulting, ISO 27001 consulting.

How Winners Consulting works

This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.

Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced, and the team holds ISO lead auditor qualifications
Applicability first: we confirm the requirements of customers, tenders, regulators and export markets, decide which laws and standards really apply, then define scope
Documents HR can run: four confidentiality templates for joining, during employment, leaving and external parties; non-competes checked clause by clause against Article 9-1 of the Labor Standards Act
One system for several requirements: ISO 27701 as the framework covering both GDPR and Taiwan's Personal Data Protection Act; ISO 27001 information classification, access control, logging and people security as evidence of reasonable confidentiality measures
A real exercise: we simulate one case of a leaver taking data and run it from logs to evidence preservation
Division of work: legal opinions come from partner lawyers; certification bodies certify and we accompany you, never auditing on their behalf
First step: the first mechanism diagnosis is free

Which named clients has Winners served in ISO 27701:2025 PIMS & GDPR Privacy Compliance Consulting?

Hypercore Fitness Center
ISO 27001 ISMS and ISO 27701 PIMS dual-certification consulting
Read the full case →
卓元科健 (Cho Yuan)
ISO 27001 ISMS and personal data protection consulting
Joint Credit Information Center (JCIC)
Internal control system integrated with ISO 27001 and TPIPAS
Lativ
Personal data protection consulting

Other engagements are anonymised by industry under NDA.

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.