Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
18. Access to personal data
Official textFrom Attorney General's Chambers, unchanged
Subject to subsections (2), (3) and (4), on request of an individual, an organisation shall, as soon as reasonably possible, provide the individual with-fa} personal data about the individual that is in the possession or under the control of the organisation; and
(b} information about the ways in which the personal data referred to in paragraph fa} has been or may have been used or disclosed by the organisation within a year before the date of the request.
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
An organisation is not required to provide an individual with the individual's personal data or other information under subsection (1) in respect of the matters specified in Schedule 3.
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
No organisation shall provide an individual with the individual's personal data or other information under subsection ( 1) if the provision of that personal data or other information could reasonably be expected to -
25
(aJ threaten the safety or physical or mental health of an individual other than the individual who made the request;
(bJ cause immediate or grave harm to the safety or to the physical or mental health of the individual who made the request;
harm
"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
(cJ reveal personal data about another individual;
(dJ reveal the identity of an individual who has provided personal data about another individual and the individual providing the personal data does not consent to the disclosure of his identity; or
(eJ be contrary to the national interest.
national interest
"national interest" includes national defence, national security, public security, the maintenance of essential services and the conduct of international affairs;
No organisation shall inform any individual under subsection ( 1){bJ that the organisation has disclosed personal data about the individual to a prescribed law enforcement agency if the disclosure was made without the consent of the individual under this Order or any other written law.
prescribed law enforcement agency
"prescribed law enforcement agency", for the purposes of sections 18(4) and 28(6){aj and Schedule 2, means a relevant authority charged with the duty of investigating offences or charging offenders under any written law, declared by the relevant Minister responsible for that authority, by notification published in the Gazette;
If an organisation is able to provide the individual with the individual's personal data and other information requested under subsection ( 1) without the personal data or other information excluded under subsections (2), (3) and (4), the organisation shall provide the individual with access to the personal data and other information without the personal data or other information excluded under subsections (2), (3) and (4).
Where, by reason of subsection (2) or (3), an organisation refuses to or otherwise does not provide an individual with the individual's personal data or other information requested under subsection ( 1), the organisation shall -
(aJ notify the individual of the refusal within the prescribed time and in accordance with the prescribed requirements; and
(bJ preserve, for not less than the prescribed period, a copy of the personal data concerned, if available.
Where an organisation provides an individual, in accordance with subsection (5), with the individual's personal data or other information requested under subsection ( 1), the organisation shall notify the individual of the exclusion of any personal data or other information so requested under subsection (2) or (3).
The organisation shall ensure that the copy of the personal data it preserves for the purposes of subsection (6)(bJ is a complete and accurate copy of the personal data concerned.
Terms defined in this Act
harm
Defined · s 30"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
national interest
Defined · s 2"national interest" includes national defence, national security, public security, the maintenance of essential services and the conduct of international affairs;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
prescribed law enforcement agency
Defined · s 2"prescribed law enforcement agency", for the purposes of sections 18(4) and 28(6){aj and Schedule 2, means a relevant authority charged with the duty of investigating offences or charging offenders under any written law, declared by the relevant Minister responsible for that authority, by notification published in the Gazette;
Part
Appeals
Part
Investigation and Offences
Part