Personal Data Protection Order 2025, cross-border transfer

Section 24 bars an organisation from transferring personal data outside Brunei Darussalam except in accordance with prescribed requirements ensuring the receiving country provides protection comparable to the Order's own standard, with the Authority empowered to grant an organisation a case-by-case exemption from any prescribed requirement.

This is a comparable-protection standard structurally identical to Singapore PDPA section 26, not a flat prohibition or a data-localization mandate; the specific prescribed requirements sit in subsidiary regulations not read this pass. This duty reaches any personal data leaving Brunei, including a voiceprint, faceprint, or other biometric identifier processed by a service, since the Order draws no sensitive-category distinction.

Government Gazette No. S 11/2025, read directly, confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 6, where section 24 sits) of the Order, so this duty is in effect from that date.