Brunei DarussalamPersonal Data Protection Order 2025, enforcement and penalties
Personal Data Protection Order, 2025 (S 1/2025), ss.37, 59
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 9 months, effective 1 January 2026.
An enforcement supervision rule binding private bodies.
As of 2 September 2026.
What it requires
- Brunei's Personal Data Protection Order 2025 has armed AITI, since section 37's financial-penalty power took effect 1 January 2026 under Government Gazette No. S 11/2025, to fine an organisation up to 10 percent of Brunei annual turnover, or up to 1,000,000 Brunei dollars for a smaller organisation. Section 59's private right of action for an individual harmed by a contravention of the Order's consent, rights, care, or breach-notification provisions sits in Part 12, which that same notification does not name, so section 59's own current commencement remains unconfirmed rather than assumed.
If you get it wrong
Private right of actionYes
Penalty structure
Section 37(3): a financial penalty imposed on an organisation under section 37(1) shall not exceed, for an organisation whose annual turnover in Brunei Darussalam exceeds BND 10,000,000, 10 percent of that turnover; in any other case, BND 1,000,000. Numerically identical in structure to Singapore PDPA section 48J. Section 37(2) excludes any contravention that is itself an offence under the Order (the Part 8 criminal offences), so this financial-penalty track and criminal prosecution under Part 8 are mutually exclusive for the same conduct.
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- BND
- Fixed cap
- 1,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Authority for Info-communications Technology Industry of Brunei Darussalam (AITI), the Order's supervisory authority under Part 2.
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) is the Order's supervisory authority under Part 2, and section 37 (Part 9) sets financial penalties of up to 10 percent of Brunei annual turnover for an organisation with turnover exceeding 10,000,000 Brunei dollars, or up to 1,000,000 Brunei dollars otherwise, numerically identical to Singapore PDPA section 48J's organisation-tier caps.
Section 59(1) (Part 12, General) gives a person who suffers loss or damage directly from a contravention of Part 4, 5, 6, or 7 a right of action for relief, including injunction, declaration, and damages, in civil proceedings; this does not extend to Part 3 (Accountability).
Separately, Part 8 creates individual criminal offences for unauthorised disclosure, improper use, and unauthorised re-identification of personal data, each carrying fines up to 5,000 Brunei dollars or up to 2 years' imprisonment.
Government Gazette No. S 11/2025 confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 of the Order (which includes Part 9's section 37 penalty power) and Schedules 1 to 5; that notification's own text lists only Parts 3 to 9, section 42, and Schedules 1 to 5, and does not name Part 12, so section 59's own private right of action may have commenced on a separate, earlier date under a prior notification that is not located, or may remain pending.
This instrument is recorded as in force on the strength of section 37's confirmed commencement, with section 59's own commencement flagged as unconfirmed rather than assumed.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived January 9, 2026. Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.