Data disclosure requirements
12. Are there any local laws that would require a cloud service provider to disclose the data it hosts to any third parties in any circumstances (including regulatory or law enforcement authorities)?

Yes. 

Criminal law enforcement: According to the Code of Criminal Procedure, public prosecutors, judicial police officers or police may request that the cloud service provider disclose data required for criminal investigations under a search warrant or a letter/notice. However, this only applies to cloud service providers within the territory of Taiwan.

Data protection law enforcement: Under Article 22 of the Personal Data Protection Act, for the purposes of conducting an audit, the Financial Supervisory Commission (FSC) or the municipality/city/county governments are entitled to request the disclosure of the data. 

According to subparagraph 5, paragraph 1, Article 18 of the draft amendments to the Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation, financial institutions are required to submit a letter of consent or outsourcing contract issued by the cloud service provider when applying for the FSC's preapproval for outsourcing. The cloud service provider must agree that the financial institutions or the person designated by the competent authority may conduct an audit of the outsourced matters if necessary. This includes the fact that the competent authority can inspect the cloud service provider's database and server room if necessary.