Brunei DarussalamPersonal Data Protection Order 2025, breach notification
Personal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdfIn force since .
A breach notification rule binding private bodies.
- Audit expectation
- none
What it requires
- Brunei's Personal Data Protection Order 2025 has required, since this duty (Part 7) took effect under Government Gazette No. S 11/2025, an organisation to notify the Authority within 3 days of assessing that a breach is notifiable, meaning it is likely to cause significant harm or is of significant scale, and to notify each affected individual, for a breach involving any personal data including a voiceprint or faceprint.
These lines are LexLint's reading of the law's text. Also read by: Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://pdp.aiti.gov.bn/media/jccpm0dx/aiti-pdp-essentials-infokit-jan-2026.pdf
- Guidance body
- Authority for Infocommunications Technology Industry of Brunei Darussalam (AITI), the authority that administers and enforces the Order
- Open questions
- When does a data breach result in 'significant harm to an affected individual' or count as 'of a significant scale' under section 26(1) of the Personal Data Protection Order 2025, given that the personal data, circumstances and 'prescribed number of affected individuals' in section 26(2) and (3) are left to be prescribed?
What it makes you log
Logging duty
Part 7 requires an organisation that has reason to believe a data breach has occurred to assess whether it is notifiable (section 27), and to notify the Authority no later than 3 days after it makes that assessment and then each affected individual (section 28). Notification is a report, and the Part does not tell the organisation to record or log breaches, assessments or notices. Section 27(3) and section 28(3) leave the assessment requirements and the notice contents to prescribed rules not read here.
- Kind
- None
- As of
What this law does
Part 7 defines a data breach as notifiable where it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale (section 26), with the specific thresholds left to regulations not read, and an internal-only breach deemed not notifiable.
Section 28 requires the organisation to notify the Authority as soon as practicable and no later than 3 days after assessing that a breach is notifiable, and to notify each affected individual, subject to exceptions where remedial measures make significant harm unlikely or a law enforcement agency or the Authority directs otherwise. This duty reaches a breach involving a voiceprint, faceprint, or other biometric identifier exactly like any other personal data.
Government Gazette No. S 11/2025 confirms the Minister appointed as the commencement date for Parts 3 to 9 (which includes Part 7) of the Order, so this duty is in effect from that date.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .