Brunei DarussalamPersonal Data Protection Order 2025, comprehensive regime
Personal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdfIn force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- none
What it requires
- Brunei's Personal Data Protection Order 2025 has been in effect since for Parts 3 to 9, section 42, and Schedules 1 to 5, the commencement date Government Gazette No. S 11/2025 directly confirms. An app that collects, uses, or discloses the personal data of a person in Brunei, including a voiceprint, faceprint, or other biometric identifier, since the Order draws no sensitive-category distinction, must obtain the individual's consent or rely on a Schedule 1, 2, or 3 consent-free basis before processing.
These lines are LexLint's reading of the law's text. Also read by: Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://pdp.aiti.gov.bn/support/faq/
- Guidance body
- Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order
- Open questions
- Does 'other information to which the organisation has or is likely to have access' in the definition of personal data in section 2 of the Personal Data Protection Order 2025 reach information held only by a third party, when deciding whether data is about an identifiable individual?
What it makes you log
Logging duty
Section 8 bars an organisation from collecting, using or disclosing personal data unless the individual gives or is deemed to have given consent, or the Order or another written law requires or authorises it. It does not tell the organisation to keep a record of the consent, and the provision that asks for consent to be in a form accessible for later reference, section 10(2)(c), covers only consent to direct marketing messages to a Brunei telephone number and is not among the sections this row cites. Section 3 states who the Order does not bind (individuals acting in a personal or domestic capacity, employees, public agencies) and sets no territorial hook.
- Kind
- None
- As of
What this law does
Brunei's Personal Data Protection Order 2025 was made under Article 83(3) of the Constitution and gazetted , but its own section 1(1) commences it only on a date appointed by ministerial notification, with different provisions able to commence on different dates.
Section 2 defines personal data as any data about an identifiable individual, with no sensitive-category tier, and section 8 (Part 4, Division 1) requires an organisation to obtain consent before collecting, using or disclosing personal data, subject to Schedule 1 and Schedule 2 consent-free bases and Schedule 3 additional bases.
Section 3(2) imposes direct duties on organisations with reduced pass-through duties on data processors, and the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) administers the Order under Part 2.
Government Gazette No. S 11/2025 confirms the Minister of Transport and Infocommunications appointed as the commencement date for Parts 3 to 9 (which includes section 8's consent duty), section 42, and Schedules 1 to 5; sections 2 and 3 sit in Part 1 (Preliminary), whose own commencement is referenced by the same notification as an earlier, separately-appointed date not independently located, though a definitional Part necessarily has practical effect once the Parts that depend on it are in force.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .