Regulations for the Security and Maintenance of Personal Information Files in Cooperative & Civil Associations-related Non-government Agencies Article 4
A non-government agency that retains members’ personal data up to an amount of 5,000 shall establish a security and maintenance plan for the protection of personal data files and a guideline on disposing personal data following an association (cooperative) affairs termination (hereinafter, "the Plans and Disposal Regulations") to implement security, maintenance, and management of personal data files to prevent the personal data from being stolen, altered, damaged, destroyed or disclosed.When establishing the Plans and Disposal Regulations in accordance with the preceding paragraph, a non-government agency shall set proper security, maintenance, and management measures with the following matters included by taking its organization size, characteristics, and the nature and quantity of the personal data to be possessed into consideration as well as referencing the requirements provided in Article 5 to Article 21. The matters of each item of Subparagraph 2 may be consolidated if necessary.1.The organization size and characteristics of the non-government agency;2.The security and management measures for the personal data files:(1)allocating management personnel and reasonable resources;(2)defining the scope of collection, processing, and use of personal data;(3)establishing a mechanism of risk assessment and management of personal data;(4)establishing a mechanism of preventing, giving notice of, and responding to a data breach;(5)establishing an internal control procedure for the collection, processing, and use of personal data;(6)establishing measures for equipment security management, data security management, and personnel management;(7)promoting awareness, education, and training;(8)establishing an audit mechanism for personal data security and maintenance;(9)keeping records, log files, and relevant evidence;(10)implementing integrated and persistent improvements on the security and maintenance of personal data; and(11)setting a guideline on disposing personal data following an association (cooperative) affairs termination.For the Plans and Disposal Regulations in Paragraph 1, it shall be filed with the competent authority for future reference within six months from the date on which the non-government agency completes its establishment or registration. For the non-government agency that has completed its establishment or registration before being designated by the competent authority according to Subparagraph 2 in the preceding Article, the Plans and Disposal Regulations shall be filed with the competent authority for future reference within 6 months from the date on which the non-government agency is designated.A non-government agency that retains personal data under an amount of 5,000, but reaching an amount of 5,000 or more due to direct or indirect collection shall file the Plans and Disposal Regulations with the competent authority for future reference within six months from the date on which the retrained data reaches an amount of 5,000.
中文原文 內政部指定合作及人民團體類非公務機關個人資料檔案安全維護管理辦法第4條
非公務機關保有會（社）員之個人資料達五千筆者，應訂定個人資料檔案安全維護計畫及會（社）務終止後個人資料處理方法（以下簡稱本計畫及處理方法），以落實個人資料檔案之安全維護及管理，防止個人資料被竊取、竄改、毀損、滅失或洩漏。
非公務機關依前項規定訂定本計畫及處理方法時，應視其組織規模、特性、保有個人資料之性質及數量等事項，參酌第五條至第二十一條規定，訂定包含下列各款事項之適當安全維護管理措施；必要時，第二款各目事項得整併之：
一、非公務機關之組織規模及特性。
二、個人資料檔案之安全管理措施：
（一）配置管理之人員及相當資源。
（二）界定蒐集、處理及利用個人資料之範圍。
（三）個人資料之風險評估及管理機制。
（四）事故之預防、通報及應變機制。
（五）個人資料蒐集、處理及利用之內部管理程序。
（六）設備安全管理、資料安全管理及人員管理措施。
（七）認知宣導及教育訓練。
（八）個人資料安全維護稽核機制。
（九）使用紀錄、軌跡資料及證據保存。
（十）個人資料安全維護之整體持續改善。
（十一）會（社）務終止後之個人資料處理方法。
第一項之本計畫及處理方法，應於完成立案或登記之日起六個月內報請主管機關備查；中央主管機關依前條第二款公告指定前，已完成立案或登記者，應於公告指定之日起六個月內報請主管機關備查。
非公務機關保有個人資料筆數未達五千筆，因直接或間接蒐集而達五千筆以上者，應於保有筆數達五千筆之日起六個月內，將本計畫及處理方法報請主管機關備查。
非公務機關依前項規定訂定本計畫及處理方法時，應視其組織規模、特性、保有個人資料之性質及數量等事項，參酌第五條至第二十一條規定，訂定包含下列各款事項之適當安全維護管理措施；必要時，第二款各目事項得整併之：
一、非公務機關之組織規模及特性。
二、個人資料檔案之安全管理措施：
（一）配置管理之人員及相當資源。
（二）界定蒐集、處理及利用個人資料之範圍。
（三）個人資料之風險評估及管理機制。
（四）事故之預防、通報及應變機制。
（五）個人資料蒐集、處理及利用之內部管理程序。
（六）設備安全管理、資料安全管理及人員管理措施。
（七）認知宣導及教育訓練。
（八）個人資料安全維護稽核機制。
（九）使用紀錄、軌跡資料及證據保存。
（十）個人資料安全維護之整體持續改善。
（十一）會（社）務終止後之個人資料處理方法。
第一項之本計畫及處理方法，應於完成立案或登記之日起六個月內報請主管機關備查；中央主管機關依前條第二款公告指定前，已完成立案或登記者，應於公告指定之日起六個月內報請主管機關備查。
非公務機關保有個人資料筆數未達五千筆，因直接或間接蒐集而達五千筆以上者，應於保有筆數達五千筆之日起六個月內，將本計畫及處理方法報請主管機關備查。