Personal Data Protection Act Article 4

Whoever is commissioned by government agencies or non-government agencies to collect, process or use personal data shall be deemed to be acting on behalf of the commissioning agency to the extent that the PDPA applies.
中文原文 個人資料保護法第4條
受公務機關或非公務機關委託蒐集、處理或利用個人資料者,於本法適用範圍內,視同委託機關。

English translation for reference only; the Chinese text prevails. Not legal advice.