← Global Privacy Laws Research Library
Brunei Darussalam Personal Data Protection Order, 2025
Prepared by Shubhank Suman · Last reviewed
ENACTED / COMMENCEMENT BY GAZETTE NOTIFICATION
- Legal character
- Statute (Emergency Order)
- Region
- Asia-Pacific
- Published
- 8 January 2025 (Government Gazette)
What it covers
The Order has 65 sections and six schedules. It governs how organisations collect, use and disclose personal data: consent and deemed consent, purpose limitation, notification of purposes, access and correction, accuracy, protection, retention limits, transfer outside Brunei, data-breach assessment and notification, data portability, and a Do-Not-Call style framework for specified messages, with enforcement by AITI.
Why it matters
It is Brunei's first general personal-data law for the private sector, closely modelled on Singapore's PDPA approach.
Refer to it when
Use it when an organisation in Brunei collects or uses personal data, transfers it abroad, suffers a data breach, or sends marketing messages.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: Very High
- Cyber: High
AI
LOW RELEVANCE
No AI-specific provisions.
Privacy
VERY HIGH RELEVANCE
General personal-data protection law for Brunei.
Cybersecurity
HIGH RELEVANCE
Protection obligation and breach notification.
Applicability
Private-sector organisations collecting, using or disclosing personal data in Brunei Darussalam.
Current validity
ENACTED. Commencement depends on a Gazette notification; the supplied Gazette does not itself show the commencement date. Confirm current commencement with AITI before relying on specific obligations. Read the official PDF on this page for the operative text.
Read first
Section 1 (commencement) → interpretation → consent obligations → protection and retention → transfer limitation → breach notification → enforcement.
Provisions / sections covered
Section 1 – Citation and commencement
The Order commences on a date appointed by the Minister, with the approval of His Majesty the Sultan and Yang Di-Pertuan, by notification in the Gazette.
Consent obligations
Organisations may collect, use or disclose personal data only with consent, deemed consent or a listed exception.
Protection, retention and transfer
Reasonable security arrangements, retention only as long as needed, and transfers abroad only with comparable protection.
Data-breach notification
Assess breaches and notify the Authority and affected individuals of notifiable breaches.
Subject-matter tags
- Consent
- Data subject rights
- Data portability
- Data breach
- Retention
- Enforcement and penalties
- Registration and notification
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.