BN-PDPO-2025
Personal Data Protection Order, 2025
Authority for Info-communications Technology Industry
🇧🇳Brunei Darussalam
Skin
Brunei Darussalam overview
Brunei's private-sector privacy regime is now operational
The Personal Data Protection Order, 2025 (PDPO) establishes a comprehensive regime for private organisations. Its substantive organisational duties commenced on 1 January 2026, and the Authority for Info-communications Technology Industry (AITI) administers the regime.
What organisations must operationalise
The PDPO addresses accountability, consent and notices, access and correction, accuracy, security, retention, overseas transfers, and notifiable data breaches. It also regulates direct-marketing messages through its Do Not Call provisions.
What this means for you
Organisations handling personal data in Brunei should maintain an accountable privacy programme, defensible consent and notice records, a rights workflow, transfer safeguards, and a breach assessment process capable of meeting the three-day authority deadline after a breach is assessed as notifiable.