Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
27. Duty to conduct assessment of data breach
Official textFrom Attorney General's Chambers, unchanged
Subject to subsection (2), where an organisation has reason to believe that a data breach affecting personal data in its possession or under its control has occurred, the organisation shall conduct, in a reasonable and expeditious manner, an assessment of whether the data breach is a notifiable data breach.
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
Where a data processor (other than a data processor mentioned in section 29) has reason to believe that a data breach has occurred in relation to personal data that the data processor is processing on behalf of and for the purposes of another organisation -
data processor
"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
30
(a} the data processor shall, without undue delay, notify the other organisation of the occurrence of the data breach; and
data breach
"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
(b} the other organisation shall, on notification by the data processor, conduct an assessment of whether the data breach is a notifiable data breach.
The organisation shall carry out the assessment mentioned m subsection (1) or 2{b} in accordance with any prescribed requirements.
Terms defined in this Act
data breach
Defined · s 25"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
data processor
Defined · s 2"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
processing
Defined · s 2"processing", in relation to personal data, means the carrying out of any operation or set of operations in relation to the personal data, and includes any of the following - (a} collection; (b) recording; (c) holding or storage; (d) organisation, structuring, adaptation or alteration; (e) retrieval; (fJ alignment or combination; (g) use; (h) disclosure by transmission, dissemination or otherwise making available; (i} erasure or destruction;
Part
Appeals
Part
Investigation and Offences
Part