Question 1

CHRO guide to HR systems: employee data, e-attendance and organizational change

Accepted Answer

For HR system transformation, settle three things first: when a vendor processes employee personal data, the vendor is treated as the commissioning party, but the company must still supervise it appropriately, check regularly and keep records; electronic attendance and payroll systems must meet the recording and retention rules of the Labor Standards Act; and access control and security must be designed together with the system. Where you only roll out a single packaged product and the process itself does not change, the software vendor's support is usually enough; overall planning is needed when cross-system integration and organizational change are involved.

Question 2

If the HR system is outsourced or moved to the cloud, who is responsible when employee data goes wrong?

Accepted Answer

Article 4 of Taiwan's Personal Data Protection Act: a party commissioned to collect, process or use personal data is, within the scope of the Act, deemed to be the commissioning party. Article 8 of the Act's Enforcement Rules requires the commissioning party to supervise the commissioned party appropriately, covering:
The scope, categories, specific purpose and period of the personal data
The security measures taken by the commissioned party
Any sub-contracting
Notification and remediation of violations
Return of media and deletion of data when the commission ends
The commissioning party must also regularly confirm how the commissioned party is performing and record the results.
When selecting and contracting, the CHRO should pin down where the data is stored, whether the vendor may use company data, whether it may sub-contract, and how data is returned and deleted at the end, and put these in the contract. How responsibility is allocated in a specific case is for legal counsel to judge.

Question 3

What legal requirements do electronic attendance and payroll systems have to meet?

Accepted Answer

Item / Rule
Attendance records / Keep for five years; record attendance daily to the minute; the employer may not refuse a worker's request for a copy (Article 30(5) and (6), Labor Standards Act)
Recording method / Sign-in books, time cards, card readers, access cards, biometric systems, computer attendance systems or any other tool that can reliably record attendance times; produce them in writing for labor inspections or at a worker's request (Article 21, Enforcement Rules of the Labor Standards Act)
Payroll register / Record wages paid, the calculation details of each wage item and total wages, and keep for five years (Article 23(2), Labor Standards Act)
The Ministry of Labor also explains that records made with any tool that can reliably record attendance times can serve as attendance records. When selecting a system, check that it records daily to the minute, can produce written output, keeps data for at least five years, and how old data is migrated and kept when you switch systems.

Question 4

How should access and security in the HR system be managed?

Accepted Answer

An HR system concentrates the most sensitive employee data, such as pay, appraisals, health and family details, so digitalization and security should go together rather than fixing security afterwards:
Access by role: authorize pay, appraisal and health data separately
Accounts follow HR changes: create, adjust or disable accounts on the day of joining, transfer or leaving, sharing the process with ISO 27001 people controls
Log access and exports: who viewed or exported what, and when
Bring it into security scope: include new cloud and data assets in the ISO/IEC 27001 scope, with risk assessment and treatment plans
Under Article 12 of the Enforcement Rules of the Personal Data Protection Act, appropriate security measures are technical and organizational measures to prevent personal data from being stolen, altered, damaged, destroyed or disclosed, and the listed items include "data security management and personnel management" and "awareness and education training". See ISO 27001.

Question 5

We want to bring overseas subsidiaries' employee data into the HQ system in Taiwan. What should we watch for?

Accepted Answer

Start with where the data comes from:
Taiwan: does every batch of personal data have a specific purpose and legal basis for collection, processing and use (Articles 19 and 20 of the Personal Data Protection Act)?
EU: the GDPR applies to any organization processing personal data of people in the EU, or offering goods or services to them or monitoring their behaviour, wherever it is established (Article 3). The EU is not a CBPR participant, so CBPR certification is not a transfer tool under GDPR Article 46; EU-to-Taiwan transfers still need SCC/BCR plus a transfer impact assessment
Certificates: neither the GDPR nor Taiwan's Personal Data Protection Act has an official certificate; compliance is shown through records such as RoPA, DPIA, contracts and transfer mechanisms. ISO 27701 shows that a privacy system exists, but it does not automatically create the GDPR's statutory procedures
How intra-group transfers of employee data should be arranged is for legal counsel to judge case by case. See GDPR consulting and ISO 27701.

Question 6

Employees' digital skills are lagging. How should the CHRO drive organizational change?

Accepted Answer

The digital skills gap is one of five risk dimensions in digital transformation (the other four are OT/IT integration security, legacy system integration, business disruption after digitalization, and personal data compliance). The CHRO can approach it like this:
Start from operating metrics: define the processes and metrics to improve, the baselines and the review cycle before choosing systems
Map changes in how people work: after each process is digitalized, whose work changes and which new skills are needed
Train by role with a transition period: run old and new processes in parallel until the metrics are stable, then retire the old process
Track results: set measurable digitalization metrics and review them regularly
How to keep operating if a system cutover or go-live causes disruption should also be handled at the planning stage, not on go-live day.

Question 7

After transformation we need to change roles or reduce headcount. What are the legal boundaries?

Accepted Answer

A framework for judgment:
Labor Standards Act, Article 11(4): where the nature of the business changes, making it necessary to reduce workers, and there is no suitable work to which they can be reassigned, the employer may terminate the labor contract with notice; you should be able to explain why there is "no suitable work"
Act for Worker Protection of Mass Redundancy: it applies where a business dismisses workers for any of the reasons in Article 11 of the Labor Standards Act, or because of a merger or reorganization, and reaches the statutory thresholds (for example, the same business dismissing more than 200 workers within 60 days or more than 100 in a single day; different thresholds apply by site size)
Procedure: at least 60 days before the thresholds are met, notify the competent authority and the relevant units or persons of the dismissal plan and publicly display it; within 10 days of submitting the plan, employer and workers must negotiate
Whether a specific case meets the conditions is for legal counsel to judge. A digital transformation roadmap should plan workforce and reskilling at the same time, so that role changes have a basis.

Question 8

How does Winners Consulting help the CHRO with digital transformation?

Accepted Answer

Winners Consulting's VP- and director-level consultants lead the work end to end, never outsourced, following a Security by Design principle that builds matching security protections at every stage of digital transformation.
Assessment and roadmap: assess digital maturity, run a digitalization risk assessment at the same time, and set a risk-controlled transformation roadmap
Integration with security: help select and implement digital tools while building a security architecture aligned with ISO 27001
Data governance: build governance for data quality, data security and data sovereignty
Business continuity: bring enterprise risk management, information security and business continuity management into transformation planning together
Change and results: support organizational change management and set measurable digitalization metrics
The service page lists a typical engagement of 7 to 12 months or more. Further reading: Digital transformation consulting, How to choose a digital transformation consultant, ISO 27001.
Apply for a free mechanism diagnosis