Cybersecurity law & regulation in Brunei (2026)

Legal framework

Cybersecurity Act, Chapter 272 (S 20/2023, Revised Edition 2024), administered by Cyber Security Brunei (CSB); complemented by the Computer Misuse Act (Chapter 194, 2007) and Personal Data Protection Order (PDPO) 2025

Key points: cybersecurity in Brunei

1. 01Cybersecurity Act (Chapter 272)

   Passed as a Legislative Order on 20 May 2023 and revised in 2024, the Act creates a comprehensive legal framework for national cybersecurity oversight, designates Cyber Security Brunei (CSB) as the competent authority, and imposes binding duties on Critical Information Infrastructure (CII) owners across ten sectors including energy, banking and finance, healthcare, and defence.

   csb.gov.bn csb.gov.bn agc.gov.bn

2. 02CII Obligations & Code of Practice

   CII owners must implement detection systems, conduct risk assessments, and follow the Code of Practice for CII issued by CSB. Non-compliance carries fines up to BND 100,000 and/or imprisonment up to 2 years, plus BND 5,000 per day for continuing offences.

   csb.gov.bn csb.gov.bn

3. 03Incident Reporting (CII, Section 16)

   Section 16 of the Cybersecurity Act requires CII owners to notify the Commissioner of Cybersecurity of prescribed cybersecurity incidents. As of 2025, the specific incident categories and reporting timelines are pending subordinate regulation, but the notification duty is in force.

   csb.gov.bn csb.gov.bn

4. 04PDPO 2025, Breach Notification

   The Personal Data Protection Order, gazetted 8 January 2025 and enforced by AITI, requires private-sector organisations to notify the Responsible Authority within 3 calendar days of assessing a data breach likely to cause significant harm to affected individuals.

   dlapiperdataprotection.com securiti.ai

5. 05Financial Sector, BDCB Sectoral Notices

   The Brunei Darussalam Central Bank (BDCB) supplements the Act with sector-specific cybersecurity notices for banks: a January 2024 Notice on Early Detection of Cyber Intrusion and Incident Reporting, a June 2023 Technology Risk Management Notice, and a 2025 Compliance and Security by Design Notice (TRS/N-2/2025/1).

   cms.bdcb.gov.bn cms.bdcb.gov.bn bdcb.gov.bn

6. 06BruCERT & National Framework

   The Brunei Computer Emergency Response Team (BruCERT), established in 2004 and operating under CSB, serves as the national CERT coordinating incident response with international CERTs, ISPs, and government agencies. CSB also maintains the voluntary Brunei National Cyber Security Framework as a risk-reduction guide for all organisations.

   csb.gov.bn csb.gov.bn

Timeline of decisions

1. 1 Apr 2024Guidance · official
   BDCB Technology Risk Management Guidelines for Financial Institutions take effect

   The Brunei Darussalam Central Bank issued binding TRM Guidelines requiring banks and financial institutions to maintain IT governance frameworks, conduct regular cyber-risk assessments, and report material technology incidents, aligning the financial sector with the Cybersecurity Act and making cyber risk the top-ranked operational risk for Bruneian banks.

   Brunei Darussalam Central Bank

2. 1 Jan 2024Law · official
   Cybersecurity Act Chapter 272 (Revised Edition 2024) and Code of Practice for CII published

   The 2023 Cybersecurity Order was consolidated into Chapter 272 of the Laws of Brunei, and Cyber Security Brunei simultaneously published the Code of Practice for Critical Information Infrastructure, giving CII owners in ten designated sectors (energy, banking, health, telecoms, etc.) detailed technical and organisational requirements for risk management, incident detection, and mandatory reporting.

   Cyber Security Brunei

3. 1 Jan 2024Guidance · official
   BDCB Notice on Early Detection of Cyber Intrusion and Incident Reporting for Banks

   The Central Bank mandated all licensed banks to deploy continuous cyber-intrusion detection systems and report incidents promptly to BDCB, creating a sector-specific incident-reporting obligation that runs in parallel with the national Cybersecurity Act obligations for critical information infrastructure.

   Brunei Darussalam Central Bank

4. 20 May 2023Law · official
   Cybersecurity Order 2023 (S 20/2023) enacted

   Brunei's first comprehensive cybersecurity statute (later codified as Chapter 272) established mandatory obligations for critical-information-infrastructure owners, empowered Cyber Security Brunei (CSB) to conduct audits and issue binding directions, and created breach-reporting duties. It is a key complement to the PDPO's data-security obligations.

   Attorney General's Chambers, Brunei Darussalam

5. 20 May 2023Law · official
   Cybersecurity Order 2023 (S 20/2023) enacted, Brunei's primary cybersecurity statute

   Brunei's first dedicated cybersecurity law established the national framework: it designated Cyber Security Brunei as the lead authority, defined ten critical information infrastructure sectors, mandated CII owners to appoint cybersecurity officers, perform risk assessments, and notify incidents, with penalties of up to BND 100,000 and two years' imprisonment for non-compliance.

   Attorney General's Chambers, Brunei

6. 1 Aug 2020Decision · official
   Cyber Security Brunei (CSB) begins operations as dedicated national cybersecurity agency

   Operating under the Ministry of Transport and Infocommunications, CSB became the institutional cornerstone of national cybersecurity, assuming oversight of BruCERT, leading policy development, and building the regulatory capacity that directly produced the 2023 Cybersecurity Order.

   Cyber Security Brunei

7. 1 Jan 2018Guidance · official
   Brunei Cybersecurity Masterplan 2018 published

   The government released a whole-of-nation Cybersecurity Masterplan covering legal reform, technical capability, organisational structures, and public awareness, setting the strategic roadmap that led to the establishment of CSB in 2020, the Cybersecurity Order in 2023, and the PDPO in 2025.

   Cyber Security Brunei

8. 1 Jan 2008Law · official
   Electronic Transactions Act 2008 enacted

   Brunei gave legal recognition to electronic records, contracts, and digital signatures, providing the secure legal basis for digital commerce and government services and underpinning later requirements for organisations to maintain integrity and availability of electronic systems.

   Council of Europe – Octopus Cybercrime Community

9. 1 May 2004Decision · official
   BruCERT established as national Computer Emergency Response Team

   On 1 May 2004 the government stood up the Brunei Computer Emergency Response Team as the national one-stop hub for detecting, analysing, and coordinating responses to cybersecurity incidents, and for international liaison with APCERT, OIC-CERT, and FIRST, Brunei's first operational cybersecurity institution.

   BruCERT

10. 1 Jan 2004Decision · official
    Brunei Computer Emergency Response Team (BruCERT) established

    BruCERT was created as the national government CERT to coordinate detection, analysis, and prevention of cybersecurity incidents. It became the central hub for international CERT liaison and set the operational foundation for what later became Cyber Security Brunei.

    Cyber Security Brunei (CSB)

11. 1 Jan 2000Law · official
    Computer Misuse Act (Chapter 194) enacted, founding cybercrime statute

    Brunei's first cyber-specific criminal law (enacted ca. 2000, revised edition 2007) criminalised unauthorised access, modification of computer material, interception of computer services, and obstruction of computer use, with penalties of up to BND 100,000 and 20 years' imprisonment for attacks on protected computers; it remains the primary cybercrime penal instrument.

    Attorney General's Chambers, Brunei

Sources

1. 1.csb.gov.bn/cybersecurity-act-chapter-272
2. 2.csb.gov.bn/sites/default/files/downloads/CybersecurityAct/CAP_272_CYBERSECURITY_
3. 3.agc.gov.bn/AGC%20Site%20Pages/CYBERSECURITY%20ACT.aspx
4. 4.agc.gov.bn/AGC%20Images/LOB/pdf/Computer%20Misuse.pdf
5. 5.csb.gov.bn/code-practice
6. 6.csb.gov.bn/sites/default/files/downloads/CodeOfPractice/CODE_OF_PRACTICE_COP_FOR
7. 7.csb.gov.bn/brucert
8. 8.csb.gov.bn/brunei-national-cyber-security-framework
9. 9.cms.bdcb.gov.bn/storage/uploads/regulatories/17138597502782500.pdf
10. 10.cms.bdcb.gov.bn/storage/uploads/regulatories/17554975698280820.pdf
11. 11.dlapiperdataprotection.com/index.html?t=breach-notification&c=BN
12. 12.securiti.ai/solutions/brunei-darussalam-personal-data-protection-order-2025/
13. 13.bdcb.gov.bn/publications/details?id=01hqjcpv1vm4kg4cg32a9w6fpe