Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
29. Obligations of data processor of public agency
Official textFrom Attorney General's Chambers, unchanged
Where an organisation-
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
{a) is a data processor processing personal data on behalf of and for the purposes of a public agency; and
data processor
"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
{b) has reason to believe that a data breach has occurred in relation to that personal data, the organisation shall, without undue delay, notify the public agency of the occurrence of the data breach.
data breach
"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
OFFENCES AFFECTING PERSONAL DATA AND
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
ANONYMISED INFORMATION
Terms defined in this Act
data breach
Defined · s 25"data breach", in relation to personal data, means - (a} the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or (b} the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
data processor
Defined · s 2"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
processing
Defined · s 2"processing", in relation to personal data, means the carrying out of any operation or set of operations in relation to the personal data, and includes any of the following - (a} collection; (b) recording; (c) holding or storage; (d) organisation, structuring, adaptation or alteration; (e) retrieval; (fJ alignment or combination; (g) use; (h) disclosure by transmission, dissemination or otherwise making available; (i} erasure or destruction;
public agency
Defined · s 2"public agency" includes - (a} the Government, including any ministry, department, agency, or organ of State; (b) any tribunal appointed under any written law; or (c) any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;
Part
Appeals
Part
Investigation and Offences
Part