Grab buys Taiwan's foodpanda, spotlighting cross-border data governance gaps
What's the deal? Grab, the Southeast Asian super-app, announced in March 2026 that it will acquire the Taiwan foodpanda delivery business from Delivery Hero for US$600 million in cash. It expects to close the deal in the second half of the year, pending regulatory approval.
Why now? The acquisition has fuelled public debate over how much personal data delivery platforms hold — order habits, payment records, and real-time location — and where that data flows when ownership changes hands.
On May 20, Grab said its app data is stored on Amazon Web Services (AWS) in Singapore and that Taiwan user data involves no Chinese suppliers. The current operator, foodpanda, said its Taiwan user data is stored in both Germany and Singapore.
The context: Cross-border data transfer is standard for multinationals, said Kenny Huang, chief executive officer of the Taiwan Network Information Center (TWNIC). Taiwan does not ban it; policy currently favours "encouraging cross-border transfer, restricting only when necessary" to support digital commerce.
"Where data is stored is not the root problem; the point is how we assess and manage risk," Huang said. The real questions, she added, are which cloud provider holds the data, who controls it, and how access is managed.
Storing data solely in one region is itself a governance weakness, Huang noted. Limiting backups to Taiwan would strip platforms of business continuity and disaster recovery (BCDR) capacity, leaving local users without failover if infrastructure fails through disaster, outage, or cyberattack.
What could go wrong? The unresolved issue, Huang said, is public trust in the review process itself. The Fair Trade Commission handles competition, but national security, labour, and industry oversight fall to separate ministries — raising the question of how independent reviews reach a balanced judgment.
She urged clear, verifiable standards over guesswork: "The government must state clearly what the concerns are and what it specifically requires, because every company operates differently." Evidence-based technical review, she argued, also shields regulators from geopolitical anxiety.
On voluntary disclosure, Huang was cautious. Over-sharing system architecture could expose companies to attacks, she warned, and regulators already have assessment tools, including Digital ministry rules and the ITRI mobile app security certification scheme.
The signal: How Taiwan reviews the Grab deal sends a message to international investors. Punishing compliant firms over perception, Huang warned, would signal a negative investment climate and weaken Taiwan's appeal to global tech capital — while consistent legal standards remain the practical path to attracting quality foreign investment.
Read more: Yahoo Finance · Reuters
Image credit: Generated with Gemini
