Home > Practices > Data Governance & Privacy

Data Governance & Privacy

Overview

Data is a critical business asset, and data governance and privacy protection have become essential in the AI era. Our services cover legal issues relating to intellectual property, personality rights, personal data, and contracts. We help businesses develop comprehensive data governance frameworks to strengthen legal compliance and risk management. This includes addressing the legality of AI training data, copyright risks in AI applications, trade secret assessments and controls, compliance with personal data laws such as Taiwan’s Personal Data Protection Act and the GDPR, and drafting privacy policies. We also assist with data lifecycle governance through legal audits and help clients manage contractual issues involving data ownership, usage rights, and data cleansing to address fragmented rights caused by large-scale data use and complex regulations.

Contact Us

Data Governance Framework Development

We help clients conduct data audits, review data lifecycle processes, assess legal risks, and establish data governance frameworks. Our services include drafting policies, contracts, and forms, and working with in-house IT teams or external security consultants to implement data security mechanisms. These efforts help businesses transform data into valuable, usable assets.

Personal Data Management Systems

With extensive experience in personal data management, we help clients audit their data practices and develop comprehensive data protection systems. We assist in implementing ISO-compliant documentation and ensuring compliance with applicable personal data laws, helping businesses minimize legal risks related to data processing and protection.

AI Risk Management

Implementing AI technologies involves various legal challenges, including copyright, trade secrets, personal data, personality rights (such as image, voice, and reputation), AI-generated content accuracy, and liability for AI-driven services. We help clients assess and manage these risks, including regulatory compliance as AI laws continue to evolve globally. Our services support clients in aligning AI deployment with legal and business risk management.

Regulatory Advisory for Products and Services

We assist clients in navigating legal requirements when developing new products or services, ensuring that their go-to-market strategies comply with applicable laws. We also support clients in managing data-related disputes by advising on appropriate responses, reviewing public statements, and preparing communications with regulators or consumers.

Data-Related Contract Drafting and Review

As data becomes central to business operations, data-specific provisions increasingly appear in commercial agreements. We help clients draft and review contracts addressing data ownership, usage rights, restrictions, and post-termination obligations. Our industry experience in sectors such as internet services, e-commerce, marketing, gaming, healthcare, and creative industries enables us to provide tailored, business-focused legal support.

Contact Us

Related Articles

Understanding Corporate Data Governance – A Legal Perspective

Data Governance is a collection of activities (planning, monitoring, and executing) that exercise authority and control over data asset management. The data governance function guides how other data management functions should be executed. Under this definition, corporate data governance refers to an organization's management and control of data during its operations to ensure data quality, availability, security, and regulatory compliance. The purpose of corporate data governance is to enable companies to effectively manage their data resources, enhance decision-making processes, and improve business operational efficiency. From a legal perspective, it concerns how data from front-end collection to back-end utilization or sharing can serve the company while avoiding illegal data collection, processing, and utilization, as well as how to avoid misuse, misjudgment, leakage, or other regulatory compliance risks. "Data is the oil of the 21st century," but data and oil differ substantially in nature. First, oil is a finite natural resource that inevitably diminishes with extraction; data, however, becomes increasingly easier to⋯

A Discussion on Corporate Data Governance Prompted by iRent’s Excessive Personal Data Collection and Usage Incident

On January 7, 2025, the Consumers' Foundation held a press conference pointing out that iRent (Hotai Motor Co., Ltd.'s car rental division) collected excessive personal data in its rental terms and required consumers to agree to share personal data with affiliated companies, potentially violating the Personal Data Protection Act. The competent authority for car rental services, the Directorate General of Highways, dispatched personnel from the Taipei City Motor Vehicles Office to conduct an administrative inspection. They determined that the reasonableness and necessity of these terms were not clear and required iRent to improve. Hotai Motor Company also shut down the joint marketing data system function within the group. This is actually an unreasonable expectation that many large enterprises in the past have had—hoping to collect data once and apply it to all "affiliated companies." Without an appropriate corporate data governance framework, common situations violating the Personal Data Protection Act emerge from service planning to data management architecture. Let's first look⋯

Trademark Infringement? Personal Data Leakage? Discussing Descriptive Fair Use of Trademarks and Personal Data Rights in Light of the Life Insurance Association’s Protest Statement Against Huibao Technology’s Use of “Insurance Passbook”

According to reports, when "Huibao Technology" under the Industrial Technology Research Institute (ITRI) announced its integrated AI insurance claims calculation platform service, it claimed that its platform integrated the "Insurance Passbook." On December 26, 2024, the Life Insurance Association issued a four-point statement emphasizing that "Insurance Passbook" is a professional service platform jointly developed by the Life Insurance Association and insurance companies and obtained trademark registration on January 1, 2024. Any unauthorized institutions or platforms may not use this name. Moreover, the use of Insurance Passbook data requires explicit authorization from the public for the association to use within a specific scope, and the public has never authorized the Life Insurance Association to provide data to "Huibao Technology." The association demanded that "Huibao Technology" immediately cease false publicity and publicly correct and explain within three days. Let's first look at the following news report: [Huibao Technology's AI Platform "Insurance Passbook" Angers Life Insurance Association, Company Issues Apology] ETtoday Finance Cloud⋯
Please Enter Keywords