Enforcement Rules of the Personal Data Protection Act Article 11
"Statutory obligations", as referred to under subparagraphs 2 and 5 of the proviso to paragraph 1 of Article 6, and subparagraph 2, paragraph 2 of Article 8 of the PDPA, shall mean the obligations of non-government agencies prescribed by laws or those regulations specifically and expressly authorized by laws.