Duty LXD-1282
Processes biometric data, in Brunei Darussalam
Personal Data Protection Order 2025, breach notificationsince 1 line
Personal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29) · Read the law's page
- Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 7) took effect under Government Gazette No. S 11/2025, an organisation to notify the Authority within 3 days of assessing that a breach is notifiable, meaning it is likely to cause significant harm or is of significant scale, and to notify each affected individual, for a breach involving any personal data including a voiceprint or faceprint.
Personal Data Protection Order 2025, cross-border transfersince 1 line
Personal Data Protection Order, 2025 (S 1/2025), s.24 · Read the law's page
- Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 6) took effect under Government Gazette No. S 11/2025, an organisation to meet a comparable-protection standard, set by regulations not yet located, before transferring personal data, including a voiceprint or other biometric identifier, outside Brunei Darussalam, unless the Authority has granted an exemption.
Personal Data Protection Order 2025, data-subject rightssince 1 line
Personal Data Protection Order, 2025 (S 1/2025), ss.18-20 · Read the law's page
- Brunei's Personal Data Protection Order 2025 has granted an individual a right to access personal data an organisation holds about them, including a voiceprint or faceprint, and a right to have inaccurate personal data corrected, since these rights (Part 5) took effect under Government Gazette No. S 11/2025. The Order names no separate deletion or data-portability right.
Personal Data Protection Order 2025, comprehensive regimesince 1 line
Personal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8 · Read the law's page
- Brunei's Personal Data Protection Order 2025 has been in effect since for Parts 3 to 9, section 42, and Schedules 1 to 5, the commencement date Government Gazette No. S 11/2025 directly confirms. An app that collects, uses, or discloses the personal data of a person in Brunei, including a voiceprint, faceprint, or other biometric identifier, since the Order draws no sensitive-category distinction, must obtain the individual's consent or rely on a Schedule 1, 2, or 3 consent-free basis before processing.