Brunei DarussalamPersonal Data Protection Order 2025, cross-border transfer
Personal Data Protection Order, 2025 (S 1/2025), s.24
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdfIn force since .
A cross border transfer rule binding private bodies.
- Audit expectation
- none
What it requires
- Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 6) took effect under Government Gazette No. S 11/2025, an organisation to meet a comparable-protection standard, set by regulations not yet located, before transferring personal data, including a voiceprint or other biometric identifier, outside Brunei Darussalam, unless the Authority has granted an exemption.
These lines are LexLint's reading of the law's text. Also read by: Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The infokit offers the ASEAN Model Contractual Clauses as a voluntary standard for cross-border transfers and tells parties that added clauses should not contravene the data protection obligations under the Order.
- As of
- Guidance link
- https://pdp.aiti.gov.bn/media/jccpm0dx/aiti-pdp-essentials-infokit-jan-2026.pdf
- Guidance body
- Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order
- Open questions
- What 'prescribed requirements' must an organisation meet under section 24(1) of the Personal Data Protection Order 2025 to show a standard of protection 'comparable to the protection under this Order' before it transfers personal data to a country outside Brunei Darussalam?
What it makes you log
Logging duty
Section 24 bars a transfer of personal data outside Brunei Darussalam except in accordance with prescribed requirements that ensure comparable protection, and lets the Authority exempt an organisation from a prescribed requirement by written notice with conditions. It states no record, log, audit or retention duty, and the prescribed requirements are in regulations not read here.
- Kind
- None
- As of
What this law does
Section 24 bars an organisation from transferring personal data outside Brunei Darussalam except in accordance with prescribed requirements ensuring the receiving country provides protection comparable to the Order's own standard, with the Authority empowered to grant an organisation a case-by-case exemption from any prescribed requirement.
This is a comparable-protection standard structurally identical to Singapore PDPA section 26, not a flat prohibition or a data-localization mandate; the specific prescribed requirements sit in subsidiary regulations not read. This duty reaches any personal data leaving Brunei, including a voiceprint, faceprint, or other biometric identifier processed by a service, since the Order draws no sensitive-category distinction.
Government Gazette No. S 11/2025 confirms the Minister appointed as the commencement date for Parts 3 to 9 (which includes Part 6, where section 24 sits) of the Order, so this duty is in effect from that date.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .