Brunei DarussalamPersonal Data Protection Order 2025, data-subject rights
Personal Data Protection Order, 2025 (S 1/2025), ss.18-20
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdfIn force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- Brunei's Personal Data Protection Order 2025 has granted an individual a right to access personal data an organisation holds about them, including a voiceprint or faceprint, and a right to have inaccurate personal data corrected, since these rights (Part 5) took effect under Government Gazette No. S 11/2025. The Order names no separate deletion or data-portability right.
These lines are LexLint's reading of the law's text. Also read by: Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://pdp.aiti.gov.bn/media/jccpm0dx/aiti-pdp-essentials-infokit-jan-2026.pdf
- Guidance body
- Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order
- Open questions
- What 'prescribed time' applies under section 18(6)(a) of the Personal Data Protection Order 2025 to an organisation's notice to an individual that it refuses to provide access to personal data?
What it makes you log
Who may demand the log
Data subject
Logging duty
An organisation that must tell an individual, on request, how the personal data has been used or disclosed in the previous year cannot do so without keeping a history of use and disclosure. Section 18(6)(b) separately requires a complete and accurate copy of data it refuses to provide to be preserved for a prescribed period that the Order leaves to regulations not read here, so no retention figure is coded. Section 19(5) requires the data to be annotated with a requested correction that was not made. None of these clauses lists record fields from the closed vocabulary or names an audit. The individual is the one entitled to the information.
- Kind
- Implicit
- As of
- Provision
- Section 18(1)(b) (on request, information about the ways the personal data has been or may have been used or disclosed within a year before the request); section 18(6)(b) (a copy of refused personal data is preserved for the prescribed period); section 19(5) (a correction requested but not made is annotated on the personal data)
- Trigger
- personal_data_processing
What this law does
Part 5 of the Order grants an individual a right of access to personal data an organisation holds about them (section 18) and a right to have inaccurate personal data corrected (section 19), with section 20 allowing either right to be exercised on the individual's behalf, for example by a legal representative.
As with Singapore's PDPA, the Order names no distinct deletion or erasure right and no data-portability provision; access and correction, subject to exceptions listed in Schedules 4 and 5, are the only named statutory rights. These rights reach a voiceprint or faceprint exactly like any other personal data the Order covers, since it draws no sensitive-category or biometric-specific distinction.
Government Gazette No. S 11/2025 confirms the Minister appointed as the commencement date for Parts 3 to 9 (which includes Part 5) of the Order, so this Part's rights are in effect from that date.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .