Personal Data Protection Order 2025, breach notification

Personal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 9 months, effective 1 January 2026.

A breach notification rule binding private bodies.

As of 29 August 2026.

What it requires

Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 7) took effect 1 January 2026 under Government Gazette No. S 11/2025, an organisation to notify the Authority within 3 days of assessing that a breach is notifiable, meaning it is likely to cause significant harm or is of significant scale, and to notify each affected individual, for a breach involving any personal data including a voiceprint or faceprint.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Part 7 defines a data breach as notifiable where it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale (section 26), with the specific thresholds left to regulations not read, and an internal-only breach deemed not notifiable.

Section 28 requires the organisation to notify the Authority as soon as practicable and no later than 3 days after assessing that a breach is notifiable, and to notify each affected individual, subject to exceptions where remedial measures make significant harm unlikely or a law enforcement agency or the Authority directs otherwise. This duty reaches a breach involving a voiceprint, faceprint, or other biometric identifier exactly like any other personal data.

Government Gazette No. S 11/2025 confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 7) of the Order, so this duty is in effect from that date.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web

Read the law

official gazette text, Attorney General's Chambers of Brunei Darussalam (agc.gov.bn), Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived January 9, 2026. Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app