Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
7. Responsibilities of organisation
Official textFrom Attorney General's Chambers, unchanged
( 1) In meeting its responsibilities under this Order, an organisation -
organisation
"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
{a) shall consider what a reasonable person would consider appropriate in the circumstances including, without limitation, -
the nature, scope and context of, and purposes for, the organisation's collection, use or disclosure of personal data;
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
and
the nature, type and amount of personal data which may be collected, used or disclosed by the organisation;
{b) is responsible for personal data in its possession or under its control;
16
(c}
shall designate one or more individuals to be responsible for ensuring that the organisation complies with this Order;
(d} shall make available to the public the business contact information of at least one of the individuals designated under paragraph (c);
(e}
shall -
develop and implement policies and practices that are necessary for the organisation to meet the obligations of the organisation under this Order;
develop a process to receive and respond to complaints that may arise with respect to the application of this Order;
communicate to its staff information about the organisation's policies and practices referred to in sub-paragraph (i); and
make information available on request about -
the policies and practices referred to in sub-paragraph (i);
the complaint process referred to in sub-paragraph (ii).
Without limiting subsection (l)(d}, an organisation is deemed to have satisfied subsection (l)(d} if the organisation makes available the business contact information of any individual mentioned in subsection (l)(c} in any prescribed manner.
business contact information
"business contact information" means an individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes;
The designation of an individual by an organisation under subsection
(c} does not relieve the organisation of any of its obligations under this Order.
Terms defined in s 2
business contact information
Defined · s 2"business contact information" means an individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes;
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
Part
Appeals
Part
Investigation and Offences
Part