Brunei Darussalam

Part 7 defines a data breach as notifiable where it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale (section 26), with the specific thresholds left to regulations not read, and an internal-only breach deemed not notifiable.

Section 28 requires the organisation to notify the Authority as soon as practicable and no later than 3 days after assessing that a breach is notifiable, and to notify each affected individual, subject to exceptions where remedial measures make significant harm unlikely or a law enforcement agency or the Authority directs otherwise. This duty reaches a breach involving a voiceprint, faceprint, or other biometric identifier exactly like any other personal data.

Government Gazette No. S 11/2025 confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 7) of the Order, so this duty is in effect from that date.

Brunei's Personal Data Protection Order 2025 was made under Article 83(3) of the Constitution and gazetted 8 January 2025, but its own section 1(1) commences it only on a date appointed by ministerial notification, with different provisions able to commence on different dates.

Section 2 defines personal data as any data about an identifiable individual, with no sensitive-category tier, and section 8 (Part 4, Division 1) requires an organisation to obtain consent before collecting, using or disclosing personal data, subject to Schedule 1 and Schedule 2 consent-free bases and Schedule 3 additional bases.

Section 3(2) imposes direct duties on organisations with reduced pass-through duties on data processors, and the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) administers the Order under Part 2.

Government Gazette No. S 11/2025 confirms the Minister of Transport and Infocommunications appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes section 8's consent duty), section 42, and Schedules 1 to 5; sections 2 and 3 sit in Part 1 (Preliminary), whose own commencement is referenced by the same notification as an earlier, separately-appointed date not independently located, though a definitional Part necessarily has practical effect once the Parts that depend on it are in force.

Section 24 bars an organisation from transferring personal data outside Brunei Darussalam except in accordance with prescribed requirements ensuring the receiving country provides protection comparable to the Order's own standard, with the Authority empowered to grant an organisation a case-by-case exemption from any prescribed requirement.

This is a comparable-protection standard structurally identical to Singapore PDPA section 26, not a flat prohibition or a data-localization mandate; the specific prescribed requirements sit in subsidiary regulations not read. This duty reaches any personal data leaving Brunei, including a voiceprint, faceprint, or other biometric identifier processed by a service, since the Order draws no sensitive-category distinction.

Government Gazette No. S 11/2025 confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 6, where section 24 sits) of the Order, so this duty is in effect from that date.

Part 5 of the Order grants an individual a right of access to personal data an organisation holds about them (section 18) and a right to have inaccurate personal data corrected (section 19), with section 20 allowing either right to be exercised on the individual's behalf, for example by a legal representative.

As with Singapore's PDPA, the Order names no distinct deletion or erasure right and no data-portability provision; access and correction, subject to exceptions listed in Schedules 4 and 5, are the only named statutory rights. These rights reach a voiceprint or faceprint exactly like any other personal data the Order covers, since it draws no sensitive-category or biometric-specific distinction.

Government Gazette No. S 11/2025 confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 (which includes Part 5) of the Order, so this Part's rights are in effect from that date.

The Authority for Info-communications Technology Industry of Brunei Darussalam (AITI) is the Order's supervisory authority under Part 2, and section 37 (Part 9) sets financial penalties of up to 10 percent of Brunei annual turnover for an organisation with turnover exceeding 10,000,000 Brunei dollars, or up to 1,000,000 Brunei dollars otherwise, numerically identical to Singapore PDPA section 48J's organisation-tier caps.

Section 59(1) (Part 12, General) gives a person who suffers loss or damage directly from a contravention of Part 4, 5, 6, or 7 a right of action for relief, including injunction, declaration, and damages, in civil proceedings; this does not extend to Part 3 (Accountability).

Separately, Part 8 creates individual criminal offences for unauthorised disclosure, improper use, and unauthorised re-identification of personal data, each carrying fines up to 5,000 Brunei dollars or up to 2 years' imprisonment.

Government Gazette No. S 11/2025 confirms the Minister appointed 1 January 2026 as the commencement date for Parts 3 to 9 of the Order (which includes Part 9's section 37 penalty power) and Schedules 1 to 5; that notification's own text lists only Parts 3 to 9, section 42, and Schedules 1 to 5, and does not name Part 12, so section 59's own private right of action may have commenced on a separate, earlier date under a prior notification that is not located, or may remain pending.

This instrument is recorded as in force on the strength of section 37's confirmed commencement, with section 59's own commencement flagged as unconfirmed rather than assumed.

Section 3 prohibits knowingly causing a computer to perform a function for the purpose of securing access, without authority, to a program or data held in any computer, with access being without authority where the person is not entitled to control access of that kind and has no consent from someone who is.

A first conviction carries a fine of up to $5,000 and imprisonment of up to 2 years, or both, rising to $10,000 and 3 years for a second or subsequent conviction, and to $50,000 and 7 years where the offence causes damage (s. 3(2)); where access to a protected computer, one used for defence, a confidential law-enforcement source, essential infrastructure, or public safety, is obtained in the course of this or certain other offences, section 9 substitutes an enhanced penalty of up to $100,000 and 20 years.

The Act's authorisation test turns on entitlement to control access rather than on infringing a technical security measure, and no reported Brunei decision has tested whether reading a public, unauthenticated page fits it.

Section 10(1) shields a network service provider from civil or criminal liability under any rule of law for third-party material in the form of electronic records to which it merely provides access, where that liability is founded on the making, publication, dissemination, or distribution of the material or a statement in it, or on an infringement of rights subsisting in the material.

Section 10(3) defines 'providing access' to mean supplying the necessary technical means by which the material may be accessed, including automatic and temporary storage for that purpose, and defines a 'third party' as a person over whom the provider has no effective control. Section 10(2) preserves any liability founded on contract, on a licensing or regulatory regime, or on a court or statutory order to remove, block, or deny access to material.

No reported Brunei decision has applied section 10 to a news aggregator that reproduces, frames, or links to a publisher's headlines and snippets rather than to a conventional access provider, and no Brunei statute or case addresses whether a hyperlink is itself a communication to the public or whether framing or inline display changes that answer.