🇧🇳Personal Data Protection Order, 2025

← Back to laws in Brunei Darussalam

Personal Data Protection Order, 2025

The PDPO governs the collection, use and disclosure of personal data by private organisations. The official English Gazette is authoritative and was reviewed before these controls were drafted.

Core operational duties

Accountability and openness: sections 5 and 6 require policies, practices, a responsible individual and publicly available contact information.

Consent, purpose and notice: sections 7 to 17 require an applicable consent rule or exception, reasonable purposes and timely purpose notification. Withdrawal must be supported.

Rights and lifecycle: sections 18 to 23 cover access, correction, accuracy, reasonable security and disposal or de-identification when retention is no longer justified.

Transfers: section 24 requires a comparable standard of protection for personal data transferred outside Brunei Darussalam.

Incidents: sections 25 to 29 require prompt assessment. A notifiable breach must be reported to the Authority as soon as practicable and no later than three days after the organisation makes that assessment; affected individuals must also be notified where the significant-harm test applies, subject to statutory exceptions.