Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
28. Duty to notify occurrence of notifiable data breach
Official textFrom Attorney General's Chambers, unchanged
Where an organisation assesses, in accordance with section 27, that a data breach is a notifiable data breach, the organisation shall notify the Authority as soon as is practicable, but in any case no later than 3 days after the day the organisation makes that assessment.
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
Subject to subsections (5), (6) and (7), on or after notifying the
Authority under subsection ( 1), the organisation shall also notify each affected individual affected by a notifiable data breach mentioned in section 26(1){a} in any manner that is reasonable in the circumstances.
Authority
"Authority" means the Authority for Info-communications Technology Industry of Brunei Darussalam established by section 3 of the Authority for Info-communications Technology Industry of Brunei Darussalam Order, 2001;
The notification under subsection (1) or (2) shall contain, to the best of the knowledge and belief of the organisation at the time it notifies the Authority or affected individual, all the information that is prescribed for this purpose.
affected individual
"affected individual" means any individual to whom any personal data affected by a data breach relates;
The notification under subsection (1) shall be made in such form and manner as the Authority may require.
Subsection (2) does not apply to an organisation m relation to an affected individual if the organisation -
(a} on or after assessing that the data breach is a notifiable data breach, takes any action, in accordance with any prescribed requirements, that renders it unlikely that the notifiable data breach will result in significant harm to the affected individual; or
data breach
"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
(b} had implemented, prior to the occurrence of the notifiable data breach, any technological measure that renders it unlikely that the notifiable data breach will result in significant harm to the affected individual.
harm
"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
No organisation shall notify any affected individual in accordance with subsection (2) if -
(a} a prescribed law enforcement agency so instructs; or 31
prescribed law enforcement agency
"prescribed law enforcement agency", for the purposes of sections 18(4) and 28(6){aj and Schedule 2, means a relevant authority charged with the duty of investigating offences or charging offenders under any written law, declared by the relevant Minister responsible for that authority, by notification published in the Gazette;
{b) the Authority so directs.
The Authority may, on the written application of an organisation, waive the requirement to notify an affected individual under subsection (2)
subject to any condition that the Authority thinks fit.
An organisation is not, by reason only of notifying the Authority under subsection ( 1) or an affected individual under subsection (2), to be regarded as being in breach of -
{a) any duty or obligation under any written law or rule of law, or any contract, as to secrecy or other restriction on the disclosure of information; or
{b) any rule of professional conduct applicable to the organisation.
Subsections ( 1) and (2) apply concurrently with any obligation of the organisation under any other written law to notify any other person (including any public agency) of the occurrence of a data breach, or to provide any information relating to a data breach.
public agency
"public agency" includes - (a} the Government, including any ministry, department, agency, or organ of State; (b) any tribunal appointed under any written law; or (c) any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;
Terms defined in this Act
affected individual
Defined · s 25"affected individual" means any individual to whom any personal data affected by a data breach relates;
Authority
Defined · s 2"Authority" means the Authority for Info-communications Technology Industry of Brunei Darussalam established by section 3 of the Authority for Info-communications Technology Industry of Brunei Darussalam Order, 2001;
data breach
Defined · s 25"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
harm
Defined · s 30"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
prescribed law enforcement agency
Defined · s 2"prescribed law enforcement agency", for the purposes of sections 18(4) and 28(6){aj and Schedule 2, means a relevant authority charged with the duty of investigating offences or charging offenders under any written law, declared by the relevant Minister responsible for that authority, by notification published in the Gazette;
public agency
Defined · s 2"public agency" includes - (a} the Government, including any ministry, department, agency, or organ of State; (b) any tribunal appointed under any written law; or (c) any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;
Part
Appeals
Part
Investigation and Offences
Part