Order · As enacted · 4 parts
Personal Data Protection Order, 2025
In plain English
Not legal adviceParts of the Order do not bind individuals acting in a personal or domestic capacity, employees at work, or public agencies. Those parts do not bind a data processor working for another organisation under a written contract, with some exceptions. That organisation stays responsible as if it handled the data itself. Personal data in records at least 100 years old falls outside the Order. Performing a contract does not excuse breaking the Order. The authority, with the minister's approval, may exempt any individual or organisation from the Order.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Part
Preliminary
Official textFrom Attorney General's Chambers, unchanged
s 1Citation, commencement and long title
( 1) This Order may be cited as the Personal Data Protection Order, 2025
and shall commence on a date to be appointed by the Minister, with the consent of His Majesty the Sultan and Yang Di-Pertuan, by notification published in the
Gazette.
Different dates may be appointed under subsection (1) for provisions of this Order or for different purposes of the same provisions.
The long title of this Order is "An Order to govern the collection, use and disclosure of personal data by organisations and for matters connected therewith".
s 2Interpretation
In this Order, unless the context otherwise requires -
9
"advisory committee" means an advisory committee appointed under section 6;
"Appeal Committee" means the Data Protection Appeal Committee constituted under section 41(2);
"Appeal Panel" means the Data Protection Appeal Panel established by section 41(1);
"authorised officer" means any person appointed as an authorised officer under section 4(2);
"Authority" means the Authority for Info-communications Technology
Industry of Brunei Darussalam established by section 3 of the Authority for
Info-communications Technology Industry of Brunei Darussalam Order,
2001 (S 39/2001);
"business" includes the activity of any organisation, whether or not carried on for purposes of gain, or conducted on a regular, repetitive or continuous basis, but does not include an individual acting in his personal or domestic capacity;
"business contact information" means an individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes;
"credit bureau" means an organisation which-
(a} provides credit reports for gain or profit; or
provides credit reports on a routine, non-profit basis as an ancillary part of a business carried on for gain or profit;
"credit report" means a communication, whether in written, oral or other form, provided to an organisation to assess the creditworthiness of an individual in relation to a transaction between the organisation and the individual;
"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
"direct marketing message" means a message, whether in sound, text, visual or other form, containing advertising or marketing material of a commercial nature which is directed to a particular individual;
"education institution" means any organisation that provides education, including instruction, training or teaching, whether by itself or in association or collaboration with or by affiliation with any other person;
"employee" has the same meaning assigned to it under the Employment
Order, 2009 (S 37/2009) and includes a volunteer;
"employment" includes working under an unpaid volunteer work relationship;
10
11 8th. JANUARY, 2025
"evaluative purpose" means-fa} for the purpose of determining the suitability, eligibility or qualifications of the individual to whom the data relates -
for employment or for appointment to office;
for promotion in employment or office or for continuance in employment or office;
for removal from employment or office;
for admission to an education institution;
for the awarding of contracts, awards, bursaries, scholarships, honours or other similar benefits;
for selection for an athletic or artistic purpose; or
for grant of financial or social assistance, or the delivery of appropriate health services, under any scheme administered by a public agency;
for the purpose of determining whether any contract, award, bursary, scholarship, honour or other similar benefit should be continued, modified or cancelled;
for the purpose of deciding whether to insure any individual or property or to continue or renew the insurance of any individual or property; or
for such other similar purposes as the Authority may determine;
"individual" means a natural person, whether living or deceased;
"investigation" means an investigation relating to -
fa} a breach of an agreement;
fb} a contravention of any written law or any rule of professional conduct or other requirement imposed by any regulatory authority in exercise of its powers under any written law; or
{cj a circumstance or conduct that may result in a remedy or relief being available under any written law;
"Minister" means the Minister responsible for personal data protection;
"national interest" includes national defence, national security, public security, the maintenance of essential services and the conduct of international affairs;
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not-
(a} formed or recognised under the law of Brunei Darussalam; or
(bJ resident, or having an office or a place of business, in Brunei
Darussalam;
"personal data" means data, whether true or not, about an individual who can be identified -
(a} from that data; or
(bJ from that data and other information to which the organisation has or is likely to have access;
"prescribed healthcare body", for the purposes of Schedule 2, means a healthcare body declared by the Minister of Health, by notification published in the Gazette;
"prescribed law enforcement agency", for the purposes of sections 18(4)
and 28(6){aj and Schedule 2, means a relevant authority charged with the duty of investigating offences or charging offenders under any written law, declared by the relevant Minister responsible for that authority, by notification published in the Gazette;
"private trust" means a trust for the benefit of one or more designated individuals who are friends, or members of the family, of the settlor;
"proceedings" means any civil, criminal or administrative proceedings by or before a court, tribunal or regulatory authority that is related to the allegation of -
(aJ a breach of an agreement;
12
13 8th. JANUARY, 2025
a contravention of any written law or any rule of professional conduct or other requirement imposed by any regulatory authority in exercise of its powers under any written law; or
a wrong or a breach of a duty for which a remedy is claimed under any law;
"processing", in relation to personal data, means the carrying out of any operation or set of operations in relation to the personal data, and includes any of the following -
(a} collection;
recording;
holding or storage;
organisation, structuring, adaptation or alteration;
retrieval;
(fJ alignment or combination;
use;
disclosure by transmission, dissemination or otherwise making available;
(i}
erasure or destruction;
"public agency" includes -
(a} the Government, including any ministry, department, agency, or organ of State;
any tribunal appointed under any written law; or
any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;
"publicly available", in relation to personal data about an individual, means personal data that is generally available to the public, and includes personal
BRUNEI DARUSSALAM GOVERNMENT GAZETTE data which can be observed by reasonably expected means at a location or an event-
(a} at which the individual appears; and
(b} that is open to the public.
Parts 3, 4, 5, 6 and 7 do not impose any obligation on-
(a} any individual acting in a personal or domestic capacity;
any employee acting in the course of his employment with an organisation;
any public agency; or
any other organisations or personal data, or classes of organisations or personal data, prescribed for the purposes of this provision.
Parts 3, 4, 5, 6 (except sections 22, 23 and 24) and 7 (except sections 27(2)(a} and 29) do not impose any obligation on a data processor in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing.
An organisation has the same obligation under this Order in respect of personal data processed on its behalf and for its purposes by a data processor as if the personal data were processed by the organisation itself.
This Order does not apply in respect of-
(a} personal data about an individual that is contained in a record that has been in existence for at least 100 years; or
personal data about a deceased individual, except that the provisions relating to the disclosure and protection of personal data apply in respect of personal data about an individual who has been dead for 10
years or fewer.
Except where business contact information is expressly referred to,
Parts 3, 4, 5, 6 and 7 do not apply to business contact information.
Unless otherwise expressly provided in this Order-
(a} nothing in Parts 3, 4, 5, 6 and 7 affects any authority, right, privilege or immunity conferred, or obligation or limitation imposed, by or under the law, including legal privilege, except that the performance of a contractual obligation is not an excuse for contravening this Order; and
the provisions of any other written law prevail to the extent that any provision of Parts 3, 4, 5, 6 and 7 is inconsistent with the provisions of that other written law.
ADMINISTRATION
s 4Administration of this Order
( 1) The Authority is responsible for the administration of this Order.
The Authority may appoint such number of authorised officers to carry into effect any specific provision of this Order or of any regulations made thereunder.
It shall be the function and duty of the Authority-
15
(a} to promote awareness of data protection in Brunei Darussalam;
to provide consultancy, advisory, training, technical, managerial or other specialist services relating to data protection;
to advise the Government on national needs and policies on matters relating to data protection;
to act internationally as the national body representative of Brunei
Darussalam on matters relating to data protection;
to conduct research and studies and promote educational activities relating to data protection, including organising and conducting seminars, workshops and symposia relating thereto, and supporting other organisations conducting such activities;
{f)
to manage technical cooperation and exchange in the area of data protection with other organisations, including foreign data protection authorities and international or intergovernmental organisations, on its own behalf or on behalf of the Government;
{g) to administer and enforce this Order; and
{h) to carry out functions conferred on the Authority under any other written law.
Nothing in this section is construed as imposing on the Authority, directly or indirectly, any form of duty or liability enforceable by proceedings before any court.
s 6Advisory committees
( 1) The Minister may appoint one or more advisory committees to provide advice to the Authority with regard to the performance of any of its functions under this Order.
The Authority may consult such advisory committees in relation to the performance of its functions and duties and the exercise of its powers under this
Order but is not bound by the consultation.
ACCOUNTABILITY FOR PERSONAL DATA
s 7Responsibilities of organisation
( 1) In meeting its responsibilities under this Order, an organisation -
{a) shall consider what a reasonable person would consider appropriate in the circumstances including, without limitation, -
the nature, scope and context of, and purposes for, the organisation's collection, use or disclosure of personal data;
and
the nature, type and amount of personal data which may be collected, used or disclosed by the organisation;
{b) is responsible for personal data in its possession or under its control;
16
(c}
shall designate one or more individuals to be responsible for ensuring that the organisation complies with this Order;
(d} shall make available to the public the business contact information of at least one of the individuals designated under paragraph (c);
(e}
shall -
develop and implement policies and practices that are necessary for the organisation to meet the obligations of the organisation under this Order;
develop a process to receive and respond to complaints that may arise with respect to the application of this Order;
communicate to its staff information about the organisation's policies and practices referred to in sub-paragraph (i); and
make information available on request about -
the policies and practices referred to in sub-paragraph (i);
the complaint process referred to in sub-paragraph (ii).
Without limiting subsection (l)(d}, an organisation is deemed to have satisfied subsection (l)(d} if the organisation makes available the business contact information of any individual mentioned in subsection (l)(c} in any prescribed manner.
The designation of an individual by an organisation under subsection
(c} does not relieve the organisation of any of its obligations under this Order.
Division 1
Consent
s 8Consent required
No organisation shall collect, use or disclose personal data about an individual unless -
17
{a} the individual gives, or is deemed to have given, his consent under this Order to the collection, use or disclosure; or
(b} the collection, use or disclosure without the consent of the individual is required or authorised under this Order or any other written law.
s 9Consent to send direct marketing messages to Brunei Darussalam telephone number
Notwithstanding section 8, no organisation shall use a Brunei Darussalam telephone number of an individual to send a direct marketing message to the individual unless -
{a} the individual gives his clear and unambiguous consent under this
Order to use his Brunei Darussalam telephone number to send a direct marketing message; or
(bj the use of the individual's Brunei Darussalam telephone number to send a direct marketing message without the consent of the individual is required or authorised under this Order or any other written law.
An individual has not given consent under this Order for the collection, use or disclosure of personal data about the individual by an organisation for a purpose unless -
(a} the individual has been provided with the information required under section 17; and
(b} the individual provided his consent for that purpose in accordance with this Order.
An individual has not given clear and unambiguous consent under this
Order for the use of his Brunei Darussalam telephone number for the purpose of receiving a direct marketing message unless -
(a} the individual has been provided with the information required under section 17;
(b} the individual provided his consent for that purpose in accordance with this Order; and
the consent of the individual is given in written or other form so as to be accessible for subsequent reference.
No organisation shall -
as a condition of providing a product or service, require an individual to consent to the collection, use or disclosure of personal data about the individual beyond what is reasonable to provide the product or service to that individual; or
obtain or attempt to obtain consent for collecting, using or disclosing personal data by providing false or misleading information with respect to the collection, use or disclosure of the personal data, or using deceptive or misleading practices.
Any consent given in any of the circumstances in subsection (3) is not validly given for the purposes of this Order.
s 11Deemed consent
( 1) An individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation for a purpose if -
the individual, without actually giving consent referred to in section 10, voluntarily provides the personal data to the organisation for that purpose; and
it is reasonable that the individual would voluntarily provide the data.
If an individual gives, or is deemed to have given, consent to the disclosure of personal data about the individual by one organisation to another organisation for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal data for that particular purpose by that other organisation.
Without limiting subsection (2) and subject to subsection (7), an individual (P} who provides personal data to an organisation (A) with a view to P entering into a contract with A is deemed to consent to the following -
19
(a} the disclosure of that personal data by A to another organisation (B), where the disclosure is reasonably necessary for the conclusion of the contract between PandA;
the collection and use of that personal data by B, where the collection and use is reasonably necessary for the conclusion of the contract between P and A;
{c)
the disclosure of that personal data by B to another organisation, where the disclosure is reasonably necessary for the conclusion of the contract between PandA.
Where an organisation collects personal data disclosed to it by B under subsection (3){c}, subsection (3){b} and {c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (3){a}.
Without limiting subsection (2) and subject to subsection (7), an individual {P} who enters into a contract with an organisation {A} and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following -
fa} the disclosure of that personal data by A to another organisation {B), where the disclosure is reasonably necessary-
for the performance of the contract between PandA; or
for the conclusion or performance of a contract between A and B which is entered into at P's request, or if a reasonable person would consider the contract to be in P's interest;
the collection and use of that personal data by B, where the collection and use are reasonably necessary for any purpose mentioned in paragraph {a};
{c) the disclosure of that personal data by B to another organisation, where the disclosure is reasonably necessary for any purpose mentioned in paragraph (a}.
Where an organisation collects personal data disclosed to it by B under subsection (5){c}, subsection (5){b} and {c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (5)(a}.
Subsections (3), (4), (5) and (6) do not affect any obligation under the contract between P and A that specifies or restricts -
{a} the personal data provided by P that A may disclose to another organisation; or
{b) the purposes for which A may disclose the personal data provided by P to another organisation.
Subject to subsection (2), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if -
(a} the organisation satisfies the requirements in subsection (3); and
the individual does not notify the organisation, before the expiry of the period mentioned in subsection (3)(b}(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
Subsection (1) does not apply to the collection, use or disclosure of personal data about the individual for the purpose of sending a direct marketing message.
For the purposes of subsection (1)(a}, the organisation shall, before collecting, using or disclosing any personal data about the individual -
21
(a} conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual; and
take reasonable steps to bring the following information to the attention of the individual -
the organisation's intention to collect, use or disclose the personal data;
the purpose for which the personal data will be collected, used or disclosed;
a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation's proposed collection, use or disclosure of the personal data.
The organisation shall, in respect of the assessment mentioned m subsection (3){a}-
fa} identify any adverse effect that the proposed collection, use or disclosure of the personal data for the relevant purpose is likely to have on the individual;
{b) identify and implement reasonable measures -
to eliminate the adverse effect;
to reduce the likelihood that the adverse effect will occur; or
to mitigate the adverse effect; and
{c) comply with any other prescribed requirements.
s 13Withdrawal of consent
( 1) On giving reasonable notice to the organisation, an individual may at any time withdraw any consent given, or deemed to have been given under this
Order, in respect of the collection, use or disclosure by that organisation of personal data about the individual for any purpose.
On receipt of the notice referred to in subsection (1), the organisation concerned shall inform the individual of the likely consequences of withdrawing his consent.
No organisation shall prohibit an individual from withdrawing his consent to the collection, use or disclosure of personal data about the individual, but this section does not affect any legal consequences arising from such withdrawal.
Subject to section 23, if an individual withdraws consent to the collection, use or disclosure of personal data about the individual by an organisation for any purpose, the organisation shall cease (and cause its data processors and agents to cease) collecting, using or disclosing the personal data, unless such collection, use or disclosure without the consent of the individual is required or authorised under this Order or any other written law.
An organisation may-
{a} collect personal data about an individual, without the consent of the individual or from a source other than the individual, in the 22
circumstances or for the purposes, and subject to any condition, in
Schedule 1 or Part 1 of Schedule 2;
{b} use personal data about an individual without the consent of the individual, in the circumstances or for the purposes, and subject to any condition, in Schedule 1 or Part 2 of Schedule 2; or
{c} disclose personal data about an individual without the consent of the individual, in the circumstances or for the purposes, and subject to any condition, in Schedule 1 or Part 3 of Schedule 2.
Unless otherwise provided under this Order, an organisation may-
{a} collect personal data about an individual that is disclosed to the organisation in accordance with subsection (1){c} for purposes consistent with the purpose of that disclosure; or
{b} use or disclose personal data about an individual that is collected by the organisation in accordance with subsection (1){a} for purposes consistent with the purpose of that collection.
Division 2
Purpose
s 15Limitation of purpose and extent
An organisation may collect, use or disclose personal data about an individual -
{a} only for purposes that a reasonable person would consider appropriate in the circumstances; and
(b} that are relevant and limited to what are reasonably necessary for its purposes.
Notwithstanding the other provisions in this Part, an organisation may use personal data about an individual collected before the date of commencement of this Order for the purposes for which the personal data was collected unless -
23
fa} consent for such use is withdrawn in accordance with section 13; or
{b} the individual, whether before, on or after the date of commencement of this Order, has otherwise indicated to the organisation that he opts-out or otherwise does not consent to the use of the personal data.
No organisation shall use a Brunei Darussalam telephone number of the individual for the purpose of sending a direct marketing message unless the organisation has given the individual a reasonable opportunity to opt-out from receiving the direct marketing message.
An organisation may collect, use or disclose personal data about an individual only for purposes that the individual has been informed of under subsection (2), if applicable.
For the purposes of section 10(1){a} and subsection (1), an organisation shall inform the individual of -
fa} the purposes for the collection, use or disclosure of the personal data on or before collecting the personal data;
{b} any other purpose of the use or disclosure of the personal data of which the individual has not been informed under paragraph {a}, before the use or disclosure of the personal data for that purpose; and
{c} on request by the individual, the business contact information of a person who is able to answer on behalf of the organisation the individual's questions about the collection, use or disclosure of the personal data.
An organisation, on or before collecting personal data about an individual from another organisation without the consent of the individual, shall provide the other organisation with sufficient information regarding the purpose of the collection to allow that other organisation to determine whether the disclosure would be in accordance with this Order.
Subsection (2) does not apply if-fa} the individual is deemed to have consented to the collection, use or disclosure under section 11 or 12; or
{b} the organisation collects, uses or discloses the personal data without the consent of the individual in accordance with section 14.
Notwithstanding subsection (4), an organisation shall comply with subsection (6) on or before collecting, using or disclosing personal data about an individual for the purpose of or in relation to the organisation -
fa} entering into an employment relationship with the individual or appointing the individual to any office; or
(b} managing or terminating the employment relationship with or appointment of the individual.
For the purposes of subsection (5), the organisation shall inform the individual of the following -
fa} the purpose for which the organisation IS collecting, using or disclosing the personal data about the individual;
(b} on request by the individual, the business contact information of a person who is able to answer the individual's questions about that collection, use or disclosure on behalf of the organisation.
RIGHTS OF INDIVIDUALS
Part
Appeals
Part
Investigation and Offences
Part