Brunei. Comprehensive data protection. Order (Emergency legislation)
PDPO (Brunei)Personal Data Protection Order, 2025
Partially in force
Partly verified
Medium confidence.DLA Piper summary partly based on consultation paper; check enacted text. [Link: official English Government Gazette S 1/2025, hosted by AITI PDP portal]
§1Summary
- Synopsis
Brunei's first private-sector data protection law, modelled closely on Singapore's PDPA. It covers consent, purpose limitation, DPO, breach notification and transfer limitation, including for organisations without a Brunei presence.
- Key themes
- Unique features
Excludes government agencies but covers their private processors; borrows Singapore's 3-day breach notice model.
- SaaS relevance
Applies to SaaS providers serving Brunei even without local presence.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority within 3 calendar days of assessment; individuals where significant harm
- DPO
- Yes
- Cross-border transfers
- Comparable protection (ASEAN MCCs recommended)
- Maximum penalty
- BND 1m or 10% of annual turnover
§3Dates
- Key dates
- Adopted
- In force
- Most substantive provisions from 2026-01-01
§4Text and authority
- Text
- Authoritative text pdp.aiti.gov.bn
- Authority
- Responsible Authority (expected: Authority for Info-communications Technology Industry, AITI)
§5Where it applies
- Domestic law of
- Brunei
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.DLA Piper summary partly based on consultation paper; check enacted text. [Link: official English Government Gazette S 1/2025, hosted by AITI PDP portal]