Brunei DarussalamPersonal Data Protection Order 2025, enforcement and penalties
Personal Data Protection Order, 2025 (S 1/2025), ss.37, 59
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdfIn force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Brunei's Personal Data Protection Order 2025 has armed AITI, since section 37's financial-penalty power took effect under Government Gazette No. S 11/2025, to fine an organisation up to 10 percent of Brunei annual turnover, or up to 1,000,000 Brunei dollars for a smaller organisation. Section 59's private right of action for an individual harmed by a contravention of the Order's consent, rights, care, or breach-notification provisions sits in Part 12, which that same notification does not name, so section 59's own current commencement remains unconfirmed rather than assumed.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Part 8 creates three offences for an individual: unauthorised disclosure of personal data (section 31), improper use of personal data (section 32) and unauthorised re-identification of anonymised information (section 33), each punishable by a fine not exceeding $5,000, imprisonment not exceeding 2 years, or both. Section 48(2) makes it an offence to obstruct the Authority, or to give it false or misleading information, punishable for an individual by a fine not exceeding $10,000, imprisonment not exceeding 12 months or both, and in any other case by a fine not exceeding $100,000. Section 49 punishes a contravention of any provision for which no penalty is expressly provided by a fine not exceeding $10,000, imprisonment not exceeding 3 years or both, and a further fine not exceeding $1,000 for each day an offence continues after conviction.
Penalty structure
Section 37(3): a financial penalty imposed on an organisation under section 37(1) shall not exceed, for an organisation whose annual turnover in Brunei Darussalam exceeds BND 10,000,000, 10 percent of that turnover; in any other case, BND 1,000,000. Numerically identical in structure to Singapore PDPA section 48J. Section 37(2) excludes any contravention that is itself an offence under the Order (the Part 8 criminal offences), so this financial-penalty track and criminal prosecution under Part 8 are mutually exclusive for the same conduct.
- Rule
- Higher of
- As of
- Currency
- BND
- Fixed cap
- 1,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Authority for Info-communications Technology Industry of Brunei Darussalam (AITI), the Order's supervisory authority under Part 2.
Settledness
- As of
- Open questions
- When has an Authority decision 'become final as a result of there being no further right of appeal' for the purpose of section 59(2) of the Personal Data Protection Order 2025, so that a civil action under section 59(1) can be brought?
What it makes you log
Logging duty
Section 37 lets the Authority require an organisation that has intentionally or negligently contravened Part 3, 4, 5, 6 or 7 to pay a financial penalty, and section 59 gives a person who suffers loss from a contravention a right of civil action. Neither section creates a record, log or audit duty. The Authority's powers to require documents and information (sections 43 to 45) and the retention of investigation records are in Part 11, which this row does not cite.
- Kind
- None
- As of
What this law does
The Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) is the Order's supervisory authority under Part 2, and section 37 (Part 9) sets financial penalties of up to 10 percent of Brunei annual turnover for an organisation with turnover exceeding 10,000,000 Brunei dollars, or up to 1,000,000 Brunei dollars otherwise, numerically identical to Singapore PDPA section 48J's organisation-tier caps.
Section 59(1) (Part 12, General) gives a person who suffers loss or damage directly from a contravention of Part 4, 5, 6, or 7 a right of action for relief, including injunction, declaration, and damages, in civil proceedings; this does not extend to Part 3 (Accountability).
Separately, Part 8 creates individual criminal offences for unauthorised disclosure, improper use, and unauthorised re-identification of personal data, each carrying fines up to 5,000 Brunei dollars or up to 2 years' imprisonment.
Government Gazette No. S 11/2025 confirms the Minister appointed as the commencement date for Parts 3 to 9 of the Order (which includes Part 9's section 37 penalty power) and Schedules 1 to 5; that notification's own text lists only Parts 3 to 9, section 42, and Schedules 1 to 5, and does not name Part 12, so section 59's own private right of action may have commenced on a separate, earlier date under a prior notification that is not located, or may remain pending.
This instrument is recorded as in force on the strength of section 37's confirmed commencement, with section 59's own commencement flagged as unconfirmed rather than assumed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .