Personal Data Protection Order, 2025 · s 37

Suggest a correction

Tell us what is wrong in this text. We check every suggestion against the official version before we change anything.

What is wrong?Wrong or mistyped wordsWrong structure or numberingWrong title or detailsText that appears twice

What should change, and whyUp to 2,000 characters.The text as it should read (optional)

37.
Financial penalties
(1) Subject to subsection (2), the Authority may, if it is satisfied that an organisation has intentionally or negligently contravened any provision of
Part 3, 4, 5, 6 or 7, require, by notice in writing, the organisation to pay a financial penalty.
(2) Subsection (1) does not apply in relation to any contravention of a provision of this Order, the breach of which is an offence under this Order.
(3) A financial penalty imposed on an organisation under subsection (1)
shall not exceed the maximum amount, which in no case may be more than the following-fa} in the case of a contravention by an organisation whose annual turnover in Brunei Darussalam exceeds $10,000,000, 10 per cent of the annual turnover of the organisation in Brunei Darussalam;
(b) in any other case, $1,000,000.
(4) The Authority shall, in determining the amount of a financial penalty imposed under subsection (1), have regard to, and give such weight as the
Authority considers appropriate to, all of the following matters -
39
(a) the nature, gravity and duration of the non-compliance by the organisation;
(b) the type and nature of the personal data affected by the non-compliance by the organisation;
(c) whether the organisation, as a result of the non-compliance, gained any financial benefit or avoided any financial loss;
(d) whether the organisation took any action to mitigate the effects and consequences of the non-compliance, and the timeliness and effectiveness of that action;
(e) whether the organisation had, notwithstanding the non-compliance, implemented adequate and appropriate measures for compliance with the requirements under this Order;
{f)
whether the organisation had previously failed to comply with this
Order;
(g) the compliance of the organisation with any direction given under section 36 or 39(4) in relation to remedying or mitigating the effect of the non-compliance;
(h) whether the financial penalty to be imposed is proportionate and effective, having regard to achieving compliance and deterring non-compliance with this Order;
(i)
the likely impact of the imposition of the financial penalty on the organisation, including the ability of the organisation to continue the usual activities of the organisation;
(j)
any other matter that may be relevant.
(5) For the purposes of subsection (3)(a), the annual turnover in Brunei
Darussalam of an organisation is the amount ascertained from the most recent audited accounts of the organisation available at the time the financial penalty is imposed on that organisation.

Edit the text above. Up to 20,000 characters.Where you checked it (optional)A link to the official version, if you have one.

The text as we hold it

Open the official text

s 37Financial penalties

(1)

Subject to subsection (2), the Authority may, if it is satisfied that an organisation has intentionally or negligently contravened any provision of

Part 3, 4, 5, 6 or 7, require, by notice in writing, the organisation to pay a financial penalty.

(2)

Subsection (1) does not apply in relation to any contravention of a provision of this Order, the breach of which is an offence under this Order.

(3)

A financial penalty imposed on an organisation under subsection (1)

shall not exceed the maximum amount, which in no case may be more than the following-fa} in the case of a contravention by an organisation whose annual turnover in Brunei Darussalam exceeds $10,000,000, 10 per cent of the annual turnover of the organisation in Brunei Darussalam;

(b)

in any other case, $1,000,000.

(4)

The Authority shall, in determining the amount of a financial penalty imposed under subsection (1), have regard to, and give such weight as the

Authority considers appropriate to, all of the following matters -

(a)

the nature, gravity and duration of the non-compliance by the organisation;

(b)

the type and nature of the personal data affected by the non-compliance by the organisation;

(c)

whether the organisation, as a result of the non-compliance, gained any financial benefit or avoided any financial loss;

(d)

whether the organisation took any action to mitigate the effects and consequences of the non-compliance, and the timeliness and effectiveness of that action;

(e)

whether the organisation had, notwithstanding the non-compliance, implemented adequate and appropriate measures for compliance with the requirements under this Order;

{f)

whether the organisation had previously failed to comply with this

Order;

(g)

the compliance of the organisation with any direction given under section 36 or 39(4) in relation to remedying or mitigating the effect of the non-compliance;

(h)

whether the financial penalty to be imposed is proportionate and effective, having regard to achieving compliance and deterring non-compliance with this Order;

(i)

the likely impact of the imposition of the financial penalty on the organisation, including the ability of the organisation to continue the usual activities of the organisation;

(j)

any other matter that may be relevant.

(5)

For the purposes of subsection (3)(a), the annual turnover in Brunei

Darussalam of an organisation is the amount ascertained from the most recent audited accounts of the organisation available at the time the financial penalty is imposed on that organisation.