Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Breach notification
What it requires →
Part 7 defines a data breach as notifiable where it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale (section 26), with the specific thresholds left to regulations not read this pass, and an internal-only breach deemed not notifiable.
Section 28 requires the organisation to notify the Authority as soon as practicable and no later than 3 days after assessing that a breach is notifiable, and to notify each affected individual, subject to exceptions where remedial measures make significant harm unlikely or a law enforcement agency or the Authority directs otherwise. This duty reaches a breach involving a voiceprint, faceprint, or other biometric identifier exactly like any other personal data.
Government Gazette No. S 11/2025, read directly, confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 7) of the Order, so this duty is in effect from that date.
Comprehensive regime
What it requires →
Brunei's Personal Data Protection Order 2025 was made under Article 83(3) of the Constitution and gazetted 8 January 2025, but its own section 1(1) commences it only on a date appointed by ministerial notification, with different provisions able to commence on different dates.
Section 2 defines personal data as any data about an identifiable individual, with no sensitive-category tier, and section 8 (Part 4, Division 1) requires an organisation to obtain consent before collecting, using or disclosing personal data, subject to Schedule 1 and Schedule 2 consent-free bases and Schedule 3 additional bases.
Section 3(2) imposes direct duties on organisations with reduced pass-through duties on data processors, and the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) administers the Order under Part 2.
Government Gazette No. S 11/2025, read directly, confirms the Minister of Transport and Infocommunications appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes section 8's consent duty), section 42, and Schedules 1 to 5; sections 2 and 3 sit in Part 1 (Preliminary), whose own commencement is referenced by the same notification as an earlier, separately-appointed date not independently located this pass, though a definitional Part necessarily has practical effect once the Parts that depend on it are in force.
Cross border transfer
What it requires →
Section 24 bars an organisation from transferring personal data outside Brunei Darussalam except in accordance with prescribed requirements ensuring the receiving country provides protection comparable to the Order's own standard, with the Authority empowered to grant an organisation a case-by-case exemption from any prescribed requirement.
This is a comparable-protection standard structurally identical to Singapore PDPA section 26, not a flat prohibition or a data-localization mandate; the specific prescribed requirements sit in subsidiary regulations not read this pass. This duty reaches any personal data leaving Brunei, including a voiceprint, faceprint, or other biometric identifier processed by a service, since the Order draws no sensitive-category distinction.
Government Gazette No. S 11/2025, read directly, confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 6, where section 24 sits) of the Order, so this duty is in effect from that date.
Data subject rights
What it requires →
Part 5 of the Order grants an individual a right of access to personal data an organisation holds about them (section 18) and a right to have inaccurate personal data corrected (section 19), with section 20 allowing either right to be exercised on the individual's behalf, for example by a legal representative.
As with Singapore's PDPA, the Order names no distinct deletion or erasure right and no data-portability provision; access and correction, subject to exceptions listed in Schedules 4 and 5, are the only named statutory rights. These rights reach a voiceprint or faceprint exactly like any other personal data the Order covers, since it draws no sensitive-category or biometric-specific distinction.
Government Gazette No. S 11/2025, read directly, confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 5) of the Order, so this Part's rights are in effect from that date.
Enforcement supervision
What it requires →
The Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) is the Order's supervisory authority under Part 2, and section 37 (Part 9) sets financial penalties of up to 10 percent of Brunei annual turnover for an organisation with turnover exceeding 10,000,000 Brunei dollars, or up to 1,000,000 Brunei dollars otherwise, numerically identical to Singapore PDPA section 48J's organisation-tier caps.
Section 59(1) (Part 12, General) gives a person who suffers loss or damage directly from a contravention of Part 4, 5, 6, or 7 a right of action for relief, including injunction, declaration, and damages, in civil proceedings; this does not extend to Part 3 (Accountability).
Separately, Part 8 creates individual criminal offences for unauthorised disclosure, improper use, and unauthorised re-identification of personal data, each carrying fines up to 5,000 Brunei dollars or up to 2 years' imprisonment.
Government Gazette No. S 11/2025, read directly, confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 of the Order (which includes Part 9's section 37 penalty power) and Schedules 1 to 5; that notification's own text lists only Parts 3 to 9, section 42, and Schedules 1 to 5, and does not name Part 12, so section 59's own private right of action may have commenced on a separate, earlier date under a prior notification this pass did not locate, or may remain pending.
This instrument is recorded as in_effect on the strength of section 37's confirmed commencement, with section 59's own commencement flagged as unconfirmed rather than assumed.
