Question 1

GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?

Accepted Answer

For a CRO, GDPR is a compliance risk: fines of up to 4% of worldwide annual turnover or EUR 20 million, whichever is higher. Check applicability first: a Taiwanese company without an EU establishment is covered only when it offers goods or services to people in the EU or monitors their behaviour in the EU (Article 3(2)). Watch intra-group flows too: under EDPB guidelines, an EU subsidiary giving employee data to a parent outside the EU can be a Chapter V transfer. GDPR has no official certificate; compliance is shown through records of processing, DPIAs, processor contracts, transfer mechanisms and notification records.

Question 2

How do GDPR fines go into the impact assessment on the risk map?

Accepted Answer

Under Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies, GDPR is a compliance risk. The maximum fine is 4% of worldwide annual turnover or EUR 20 million (whichever is higher), which can serve as a reference for the lower bound of impact. But fines are only part of the impact: customer requirements, market access and reputational damage usually come earlier and belong in the same assessment.
The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.

Question 3

We have no EU establishment. Can GDPR apply, and what does the CRO decide first?

Accepted Answer

Two things first; get them wrong and the documents and contracts that follow must be redone:
Scope: a Taiwanese company without an EU establishment is covered only when it offers goods or services to people in the EU or monitors their behaviour in the EU (for example through cookie tracking) (Article 3(2)).
Role: for each business line, whether you are a controller, joint controller or processor (Articles 24, 26, 28); the obligations differ.
When Article 3(2) applies, also decide whether an EU representative must be designated under Article 27.

Question 4

Our EU subsidiary sends employee data to the Taiwan parent for HR management. Is that a cross-border transfer?

Accepted Answer

It can be. EDPB Guidelines 05/2021 set three cumulative criteria for a "transfer": the exporter is subject to the GDPR for the processing; the exporter discloses or makes personal data available to another controller or processor (the importer); and the importer is in a third country. The guidelines add that entities in the same corporate group may be separate controllers or processors, so disclosures within a group can be transfers; in their Example 9, an Irish subsidiary sharing employee data with a parent company in a third country is a transfer under Chapter V. By contrast, an employee travelling to a third country and accessing company data remotely is not a transfer.
Taiwan currently has no EU adequacy decision, so a transfer needs Article 46 safeguards (Taiwanese companies most often use standard contractual clauses, SCCs). Whether a specific case is a transfer is for legal counsel to judge case by case.

Question 5

GDPR has no certificate. What evidence should the CRO present to the committee?

Accepted Answer

There is no official GDPR certificate; compliance is shown through these records:
Records of processing activities (RoPA, Article 30)
Data protection impact assessments (DPIA, Article 35)
Processor contracts (Article 28)
Transfer mechanisms (SCC/BCR)
Breach notification records
ISO 27701 certification can show a systematic capability to manage GDPR compliance, but it is not legal compliance with GDPR. TWSE ESG indicator S-13 (A item) also asks whether a personal data protection policy has been set and its content and implementation disclosed; the ESG evaluation covers listed companies, and companies that are not public companies are not covered and can use it voluntarily.

Question 6

What should a data breach exercise test, and will the 72-hour deadline change?

Accepted Answer

The current deadline under Article 33 is 72 hours. An exercise should test the decisions: who decides whether to notify, and which member states' supervisory authorities to notify — without an EU establishment there is no one-stop shop. A processor must notify the controller of a breach (Article 33(2)).
The Digital Omnibus proposed by the European Commission on 19 November 2025 (2025/0360(COD)) would extend the deadline to 96 hours and raise the threshold; the proposal is still in the legislative process, and the deadline remains 72 hours.

Question 7

How long does GDPR compliance take?

Accepted Answer

As listed on the service page: baseline compliance (RoPA + privacy policy + SOPs) usually 2–3 months; with ISO 27701 certification 5–8 months, shortened to 3–5 months with an ISO 27001 base.
Five steps: personal data inventory and RoPA, DPIA, system and documents, cross-border transfer mechanisms and DPO, ISO 27701 certification preparation and ongoing compliance.

Question 8

How does Winners Consulting help CROs with GDPR?

Accepted Answer

One system: GDPR and Taiwan's Personal Data Protection Act integrated in the ISO 27701 PIMS framework, one system for both without duplication
Transfers: review of SCC clauses, transfer impact assessment and complete transfer records
Exercises and review: 72-hour breach notification exercises and an annual review
Who leads: vice-president and director-level consultants lead personally end to end, never outsourced
Named clients (personal data protection): Joint Credit Information Center (JCIC), Lativ, 卓元科健 (Cho Yuan), Hypercore Fitness Center
GDPR consulting, Choosing a GDPR consultant, ISO 27701. Request a free mechanism diagnosis