GDPR and ISO 27701 for the CHRO: employee data, transfers and monitoring

Is sending EU subsidiary staff data to the HR system at our Taiwan headquarters a cross-border transfer?

Usually, yes. EDPB Guidelines 05/2021 say a Chapter V "transfer" exists when three conditions are all met: the exporter is subject to the GDPR for the processing; the exporter transmits or makes the data available to another controller or processor; and the importer is in a third country. Companies in the same group can be separate controllers or processors, and Example 9 in the guidelines is an EU subsidiary sharing data with its parent company in a third country.

Taiwan currently has no EU adequacy decision, so you need a safeguard:

Article 88(2) GDPR also requires Member State employment rules to pay particular regard to transfers of personal data within a group of undertakings. Whether the Taiwan headquarters is a controller or a processor, and which tool to use, is for legal counsel to judge based on the group structure.

How does Taiwan's privacy law treat Taiwanese staff data stored in an overseas cloud or sent to an overseas parent company?

Taiwan's Personal Data Protection Act lets the authorities restrict international transfers. Under the current Article 21, where a non-government entity transfers personal data internationally and one of the listed circumstances applies, the central competent authority may restrict the transfer. The listed circumstances include:

• the receiving country lacks sound laws protecting personal data, so the data subject's rights may be harmed
• personal data is routed indirectly to a third country (region) to evade the Act

Authorities have used this power: for example, a 2012 order by the National Communications Commission bars telecommunications and broadcasting businesses from transferring subscribers' personal data to mainland China.

HR has three jobs: check whether the competent authority for your industry has imposed a restriction; keep the transfer within what the specific purpose requires (Article 5); and record the recipient and purpose in your record of processing. The amendments promulgated on 11 November 2025 (including Article 21) take effect on a date set by the Executive Yuan; until then the current text applies.

If employees sign a personal data consent form, can we process their data?

Not on the consent form alone.

• EU: Recital 43 GDPR says consent should not be a valid legal ground where there is a clear imbalance between the data subject and the controller. EDPB Guidelines 05/2020 on consent add that, given the dependency in the employer/employee relationship, it is problematic for employers to process personal data of current or future employees on the basis of consent; employees can give free consent only in exceptional circumstances, when there are no adverse consequences at all whether or not they consent.
• Taiwan: a 5 December 2013 letter from the Ministry of Justice on employee consent forms says the form must first be checked against Article 5(2)(ii) of the Employment Service Act, and that the company cannot be excused on the written consent alone; it also notes that the Personal Data Protection Act does not require a signed consent form in every case.

In practice, write down the purpose and basis for each category of employee data, for example the purposes listed in Article 88(1) GDPR such as recruitment, performance of the employment contract, and health and safety at work, and keep consent for items employees can genuinely choose. Whether a basis holds is for legal counsel to judge.

What should we watch for in employee monitoring (email, web logs, DLP, access-control video)?

The framework differs by jurisdiction:

• EU: Article 88 GDPR lets Member States set more specific employment rules by law or collective agreement, with particular regard to the transparency of processing and monitoring systems at the work place. In its 30 March 2023 judgment in C-34/21, the Court of Justice held that national provisions that do not meet the conditions of Article 88(2) cannot be a "more specific rule". Monitoring at an EU subsidiary therefore has to be judged country by country under local rules.
• Taiwan: Article 5 of the Personal Data Protection Act requires collection, processing and use not to exceed what the specific purpose requires, and to have a legitimate and reasonable connection with the purpose of collection.

Before go-live, write down the purpose, the people and data covered, how employees are told in advance, how long data is kept and who can access it. Logs needed for security and trade secret protection can share rules with ISO 27001 log management. Whether a data protection impact assessment (DPIA) is required is for legal counsel to judge.

What data can we ask job applicants for? Can we ask for background checks, credit or criminal records?

In Taiwan, start with Article 5(2)(ii) of the Employment Service Act: an employer may not, against the applicant's or employee's will, require private information not needed for employment. Article 1-1 of its Enforcement Rules requires that such requests not exceed what a specific purpose, such as economic need or the public interest, requires, and that they have a legitimate and reasonable connection with that purpose. A 2013 Ministry of Justice letter explains that private information includes personal life information such as credit records, criminal records, pregnancy plans or background checks.

In practice:

• Review every field on application, interview and background check forms, and remove those unrelated to the role
• Ask for specific data only for roles that really need it, and write down why
• Set retention and deletion periods for data on unsuccessful applicants

For applicants in the EU, Article 88(1) GDPR names recruitment as a purpose for which Member States may set more specific rules, so check local rules too. Whether a given case is unlawful is for legal counsel to judge.

What does HR need to show the board and the ESG evaluation? Is ISO 27701 worth it?

• ESG evaluation item S-13 (same wording in the 2026 and 2027 evaluations): has the company adopted a personal data protection policy and disclosed its content and implementation? Records of processing for employee data, transfer records, monitoring notices and breach drill records can all evidence implementation. The evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.
• ISO/IEC 27701:2025: published on 14 October 2025; you can build and certify a privacy information management system (PIMS) without ISO 27001, giving customer audits and questionnaires evidence to work with. The certificate is not legal GDPR compliance; the Article 27 EU representative, the choice of SCC module and whether a DPIA is mandatory are legal judgments ISO 27701 does not make.
• Timeline (as listed on the service page): GDPR baseline compliance usually takes 2–3 months; integrating ISO 27701 certification takes 5–8 months, or 3–5 months if you already hold ISO 27001.

How does Winners Consulting help a CHRO with GDPR and ISO 27701?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
• Employee data inventory: we map data types, sources, purposes, retention periods and recipients, and determine GDPR scope and controller and processor roles
• One system: with ISO 27701 as the backbone, we map each GDPR obligation to a control, covering Taiwan's Personal Data Protection Act at the same time
• Transfers: we help review standard contractual clauses, assess transfer impact and build transfer records
• 72-hour notification: we set up breach notification drills and an annual review
• Division of work: legal opinions come from partner lawyers; certification is by a third-party certification body, which we accompany, never auditing on its behalf
• Named clients: clients who have authorised disclosure of our personal data protection work include the Joint Credit Information Center (JCIC), Lativ, 卓元科健 (Cho Yuan) and Hypercore Fitness Center

More: GDPR consulting, ISO 27701 consulting, Choosing a GDPR consultant, ISO 27701 budget, CISO role page