Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
12. Deemed consent by notification
Official textFrom Attorney General's Chambers, unchanged
Subject to subsection (2), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if -
(a} the organisation satisfies the requirements in subsection (3); and
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
the individual does not notify the organisation, before the expiry of the period mentioned in subsection (3)(b}(iii), that the individual does not consent to the proposed collection, use or disclosure of the personal data by the organisation.
Subsection (1) does not apply to the collection, use or disclosure of personal data about the individual for the purpose of sending a direct marketing message.
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
For the purposes of subsection (1)(a}, the organisation shall, before collecting, using or disclosing any personal data about the individual -
21
(a} conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual; and
take reasonable steps to bring the following information to the attention of the individual -
the organisation's intention to collect, use or disclose the personal data;
the purpose for which the personal data will be collected, used or disclosed;
a reasonable period within which, and a reasonable manner by which, the individual may notify the organisation that the individual does not consent to the organisation's proposed collection, use or disclosure of the personal data.
The organisation shall, in respect of the assessment mentioned m subsection (3){a}-
fa} identify any adverse effect that the proposed collection, use or disclosure of the personal data for the relevant purpose is likely to have on the individual;
{b) identify and implement reasonable measures -
to eliminate the adverse effect;
to reduce the likelihood that the adverse effect will occur; or
to mitigate the adverse effect; and
{c) comply with any other prescribed requirements.
Terms defined in this Act
direct marketing message
Defined · s 2"direct marketing message" means a message, whether in sound, text, visual or other form, containing advertising or marketing material of a commercial nature which is directed to a particular individual;
disclose
Defined · s 30"disclose", in relation to personal data, includes providing access to personal data;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
Part
Appeals
Part
Investigation and Offences
Part