The purpose of this Article is to compare the researching use of sensitive data provisions between Taiwan’s Personal Data Protection Act and other countries’ laws, especially EU General Personal Data Protection Regulation and U.S. HIPAA privacy rule. The Section 6(4) and 16(5) of Personal Data Protection Act regulate the research use of personal data. The research exception in the Section 6(4) and 6(5) are also too strictly. All these limitations let the Ministry of Health and Welfare face difficulty to release the national-people-health-insurance database for external research, and there were some human rights groups had questioned the practices. In this paper, the research use clauses in EU 1995 personal data directive and EU 2016 General Data Protection Regulation will be thoroughly introduced and analyzed. Then, the researching use of personal health information under U.S. HIPAA privacy rule will be detailed analyzed. After compare the legislations and regulations between EU, the U.S. and Taiwan, this study suggests that there are many wrongs in the legislation and amendment of researching-use provision in Taiwan. In one hand, I argued that restrictions of research exception in Section 6(4) and Section 16(5) of Personal Data Protection Act are too excessive: 1. the researcher need not to be academic institution, 2. the purpose of research need not to be public interest, and 3. the data need not to be de-identified. In the other, I suggested that IRB or privacy board should review the researcher’s protocols before they can get the sensitive information, and IRB may immune the informed-consent requirement if they think the risk of privacy is very low.