Personal Data Protection Order 2025, comprehensive regime

Brunei's Personal Data Protection Order 2025 was made under Article 83(3) of the Constitution and gazetted 8 January 2025, but its own section 1(1) commences it only on a date appointed by ministerial notification, with different provisions able to commence on different dates.

Section 2 defines personal data as any data about an identifiable individual, with no sensitive-category tier, and section 8 (Part 4, Division 1) requires an organisation to obtain consent before collecting, using or disclosing personal data, subject to Schedule 1 and Schedule 2 consent-free bases and Schedule 3 additional bases.

Section 3(2) imposes direct duties on organisations with reduced pass-through duties on data processors, and the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) administers the Order under Part 2.

Government Gazette No. S 11/2025, read directly, confirms the Minister of Transport and Infocommunications appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes section 8's consent duty), section 42, and Schedules 1 to 5; sections 2 and 3 sit in Part 1 (Preliminary), whose own commencement is referenced by the same notification as an earlier, separately-appointed date not independently located this pass, though a definitional Part necessarily has practical effect once the Parts that depend on it are in force.