Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
26. Notifiable data breaches
Official textFrom Attorney General's Chambers, unchanged
( 1) A data breach is a notifiable data breach if the data breach -
data breach
"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
fa} results in, or is likely to result in, significant harm to an affected individual; or
harm
"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
{b) is, or is likely to be, of a significant scale.
Without limiting subsection (1){a}, a data breach is deemed to result in significant harm to an individual -
fa} if the data breach is in relation to any prescribed personal data or class of personal data relating to the individual; or
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
{b) in other prescribed circumstances.
Without limiting subsection (1){b}, a data breach is deemed to be of a significant scale -
fa} if the data breach affects not fewer than the prescribed number of affected individuals; or
in other prescribed circumstances.
Notwithstanding subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
Terms defined in this Act
affected individual
Defined · s 25"affected individual" means any individual to whom any personal data affected by a data breach relates;
data breach
Defined · s 25"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
harm
Defined · s 30"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
Part
Appeals
Part
Investigation and Offences
Part