Customer Privacy Protection

When customers access services of Chunghwa Telecom, we collect their personal/private data out of the regulatory requirement for identity verification or the needs for service provision.

Data Retention Period

Upon termination of contractual relationship between customers and us, the personal data will be retained for a minimum of one year in compliance with the Telecommunications Management Act and other pertaining laws and regulations, which will be deleted after the defined period of time with (non-personal) data generated in a form that does not identify the customer retained. We will not collect personal data from third parties as well, unless consented by the customers or specified otherwise by laws and regulations.

Data Protection and Privacy enhancing technologies (PETs)

Upholding "Privacy by Design" as our core principle, we reference the Guidelines for the Application of Privacy-Enhancing Technologies by the Ministry of Digital Affairs (MODA) to incorporate the outlined technical implementation processes, risk assessments, and applied principles into the overall considerations of our privacy protection mechanisms. Also, throughout the planning, development, and operational lifecycles of our products and services, data protection requirements are systematically integrated into our architectural and process designs, ensuring that data utility needs, regulatory compliance, as well as safety and security are included from the very inception of the design phase. 

The specific governance and implementation practices are as follows: 

1. Prior to launching new services, expanding business operations, or deploying AI applications, risk assessments and privacy impact assessments (PIAs) are conducted in accordance with internal procedures to identify data types, potential threats, impact magnitude, and likelihood of occurrence. Process and security controls are then implemented based on the results, ensuring that data protection measures are embedded at the design phase.
2. All information systems involving personal data, sensitive data, or critical infrastructure services are included in the monitoring scope of the Chunghwa Telecom Security Operations Center (CHT SOC). Through the architecture of diversity and defense-in-depth for security and institutionalized vulnerability management mechanisms, vulnerability scanning, penetration testing, and patching or contingency operations for critical security updates are continuously executed. In addition, these systems maintain third-party certification of ISO 27001 to guarantee data security.
3. The allocation of data access and use permissions strictly adheres to the principle of least privilege per business necessity, ensuring that data is used solely within the scope of lawful, legitimate, and specific purposes to mitigate the risks of unauthorized access and misuse. 
4. Complete system logs are retained whenever internal personnel access or utilize personal data of customers during business execution. Also, it is managed through a systematic cross-check and review mechanism to safeguard against any potential misuse. 
5. We have achieved third-party certifications for personal data and privacy management systems, including ISO/IEC 27701, BS 10012, and CNS 29100. In alignment with pertaining standard requirements, appropriate managerial and technical measures, including access controls, data encryption in transit and at rest, and de-identification technologies, are adopted throughout our data analysis and processing workflows, so as to ensure that data remains protected during all stages of processing and exchange.
6. De-identification or other data minimization techniques, including privacy-enhancing technologies such as suppression, pseudonymization, generalization, randomization, aggregation and masking, are employed to limit the amount of specific personal data and personal information for collection or processing, which apply to a range of data such as the names, ID numbers, birthdays, addresses, and email accounts of customers. The results of de-identification are presented as statistical data, trends, or other non-identifiable forms as the basis for business decisions (such as consumer age/geographical distribution, regional signal improvement, etc.), in order to fully protect the privacy of our customers.

In addition, the Number Masking Service at Chunghwa Telecom serves as a concrete case of integrating Privacy-Enhancing Technologies (PETs) directly into our products and services. At the system and process design layers, the service masks consumers' actual phone numbers, effectively preventing data breach and telecom fraud risks. The service has been successfully deployed across e-commerce, logistics, and our internal telecom installation and maintenance operations, demonstrating our tangible achievements in ceaselessly strengthening customer data security and privacy trust.

Policy for Disclosure to Third Parties

Personal data and privacy will not be disclosed to a third party by means of exchange, lease, or otherwise at will, unless consented by the customers or specified otherwise by laws and regulations, we may share personal data and privacy with a third party:

Requests for Customer Information Received from Government or Law Enforcement Agencies

We are liable to protect customer’s secrecy of correspondence and privacy from illegal infringement in accordance with the laws. Only when government agency or law enforcement agency presents Chunghwa Telecom a letter in line with the laws to request access or inquire information of customers to protect public security, fight crimes, or maintain social order can we provide customer information thereto.

In compliance with the requirements, dedicated departments and rigorous review procedures for access are in place. Relevant information can only be provided in accordance with the laws upon criteria met, which will not be available otherwise.

In 2025, 1,690,509 requests were made by the government or law enforcement agencies for inquiries of our user information. The ratio of provision was 43.79%(740,190 requests) and that of rejection 56.21%(950,319 requests), most of which were primary due to inconformity to the relevant laws and regulations or source data error.