Enforcement Rules of the Personal Data Protection Act Article 8
When commissioning another to collect, process or use personal data, the commissioning agency shall properly supervise the commissioned agency.The scope of supervision prescribed in the preceding paragraph shall include at least the followings:1. the planned scope, category, specific purpose and time period of the collection, processing or use of personal data;2. the measures taken by the commissioned agency in accordance with paragraph 2 of Article 12;3. the third party, if any, further commissioned by the commissioned agency;4. the information that must be notified to the commissioning agency and the remedial measures that must be taken in the event that the commissioned agency or its employees violate(s) the PDPA or other laws and regulations relating to the protection of personal data;5. any reserved matters for which the commissioned agency is required to obtain prior instructions from the commissioning agency; and6. the return of any medium containing personal data and the deletion of any personal data stored and possessed by the commissioned agency due to its performance of the engagement contract between the commissioning agency and the commissioned agency, upon the termination or cancellation thereof.For the purpose of supervision prescribed under paragraph 1, the commissioning agency shall carry out regular inspections to verify the commissioned agency's performance of the engagement contract and document the findings of such inspections.The commissioned agency may collect, process or use personal data but only to the extent within the commissioning agency's instructions. If the commissioned agency considers that the commissioning agency's instructions are in contravention of the PDPA or other laws and regulations relating to the protection of personal data, the commissioned agency shall forthwith notify the commissioning agency.
中文原文 個人資料保護法施行細則第8條
委託他人蒐集、處理或利用個人資料時，委託機關應對受託者為適當之監督。
前項監督至少應包含下列事項：
一、預定蒐集、處理或利用個人資料之範圍、類別、特定目的及其期間。
二、受託者就第十二條第二項採取之措施。
三、有複委託者，其約定之受託者。
四、受託者或其受僱人違反本法、其他個人資料保護法律或其法規命令時，應向委託機關通知之事項及採行之補救措施。
五、委託機關如對受託者有保留指示者，其保留指示之事項。
六、委託關係終止或解除時，個人資料載體之返還，及受託者履行委託契約以儲存方式而持有之個人資料之刪除。
第一項之監督，委託機關應定期確認受託者執行之狀況，並將確認結果記錄之。
受託者僅得於委託機關指示之範圍內，蒐集、處理或利用個人資料。
受託者認委託機關之指示有違反本法、其他個人資料保護法律或其法規命令者，應立即通知委託機關。
前項監督至少應包含下列事項：
一、預定蒐集、處理或利用個人資料之範圍、類別、特定目的及其期間。
二、受託者就第十二條第二項採取之措施。
三、有複委託者，其約定之受託者。
四、受託者或其受僱人違反本法、其他個人資料保護法律或其法規命令時，應向委託機關通知之事項及採行之補救措施。
五、委託機關如對受託者有保留指示者，其保留指示之事項。
六、委託關係終止或解除時，個人資料載體之返還，及受託者履行委託契約以儲存方式而持有之個人資料之刪除。
第一項之監督，委託機關應定期確認受託者執行之狀況，並將確認結果記錄之。
受託者僅得於委託機關指示之範圍內，蒐集、處理或利用個人資料。
受託者認委託機關之指示有違反本法、其他個人資料保護法律或其法規命令者，應立即通知委託機關。