Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
3. Application of Order
Official textFrom Attorney General's Chambers, unchanged
Parts 3, 4, 5, 6 and 7 do not impose any obligation on-
(a} any individual acting in a personal or domestic capacity;
any employee acting in the course of his employment with an organisation;
any public agency; or
any other organisations or personal data, or classes of organisations or personal data, prescribed for the purposes of this provision.
Parts 3, 4, 5, 6 (except sections 22, 23 and 24) and 7 (except sections 27(2)(a} and 29) do not impose any obligation on a data processor in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing.
data processor
"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
An organisation has the same obligation under this Order in respect of personal data processed on its behalf and for its purposes by a data processor as if the personal data were processed by the organisation itself.
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
This Order does not apply in respect of-
(a} personal data about an individual that is contained in a record that has been in existence for at least 100 years; or
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
personal data about a deceased individual, except that the provisions relating to the disclosure and protection of personal data apply in respect of personal data about an individual who has been dead for 10
years or fewer.
Except where business contact information is expressly referred to,
business contact information
"business contact information" means an individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes;
Parts 3, 4, 5, 6 and 7 do not apply to business contact information.
Unless otherwise expressly provided in this Order-
(a} nothing in Parts 3, 4, 5, 6 and 7 affects any authority, right, privilege or immunity conferred, or obligation or limitation imposed, by or under the law, including legal privilege, except that the performance of a contractual obligation is not an excuse for contravening this Order; and
Authority
"Authority" means the Authority for Info-communications Technology Industry of Brunei Darussalam established by section 3 of the Authority for Info-communications Technology Industry of Brunei Darussalam Order, 2001;
the provisions of any other written law prevail to the extent that any provision of Parts 3, 4, 5, 6 and 7 is inconsistent with the provisions of that other written law.
ADMINISTRATION
Terms defined in s 2
Authority
Defined · s 2"Authority" means the Authority for Info-communications Technology Industry of Brunei Darussalam established by section 3 of the Authority for Info-communications Technology Industry of Brunei Darussalam Order, 2001;
business contact information
Defined · s 2"business contact information" means an individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes;
data processor
Defined · s 2"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;
employee
Defined · s 2"employee" has the same meaning assigned to it under the Employment Order, 2009 and includes a volunteer;
employment
Defined · s 2"employment" includes working under an unpaid volunteer work relationship; 11 8th. JANUARY, 2025
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
processing
Defined · s 2"processing", in relation to personal data, means the carrying out of any operation or set of operations in relation to the personal data, and includes any of the following - (a} collection; (b) recording; (c) holding or storage; (d) organisation, structuring, adaptation or alteration; (e) retrieval; (fJ alignment or combination; (g) use; (h) disclosure by transmission, dissemination or otherwise making available; (i} erasure or destruction;
public agency
Defined · s 2"public agency" includes - (a} the Government, including any ministry, department, agency, or organ of State; (b) any tribunal appointed under any written law; or (c) any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;
Part
Appeals
Part
Investigation and Offences
Part