Data protection & privacy law in Brunei (2026)

Legal framework

Personal Data Protection Order 2025 (S 1/2025), supervised by the Authority for Info-Communications Technology Industry of Brunei Darussalam (AITI)

Key points: data & privacy in Brunei

1. 01Enactment & commencement

   The PDPO was gazetted as Subsidiary Legislation S 1/2025 on 8 January 2025 after approval by His Majesty the Sultan. Key operative parts commenced 1 January 2026, with a one-year compliance grace period for organisations to align practices.

   agc.gov.bn pdp.aiti.gov.bn

2. 02Scope

   The PDPO covers private-sector companies and NGOs (including those handling data on behalf of public bodies). Government agencies and public-sector bodies are expressly excluded and remain governed by existing instruments such as the Official Secrets Act (Cap. 153).

   agc.gov.bn dataguidance.com

3. 03Data subject rights

   Individuals are granted rights to be informed of data-collection purposes, to access and correct their personal data, to opt in or out of processing, and to withdraw consent at any time. A private right of action is also available to data subjects.

   thescoop.co dataguidance.com

4. 04Data Protection Officer (DPO) obligation

   Organisations subject to the PDPO must appoint at least one Data Protection Officer responsible for ensuring compliance. AITI published a formal Guide for Appointment of Data Protection Officers (Version 1.0, June 2025) to support implementation.

   aiti.gov.bn aiti.gov.bn

5. 05Supervisory authority, AITI

   The Authority for Info-Communications Technology Industry of Brunei Darussalam (AITI) is the designated data-protection regulator. AITI operates a dedicated PDP portal, issues guidance, and runs a Competency Programme for DPOs leading to CIPM certification.

   aiti.gov.bn pdp.aiti.gov.bn

6. 06Penalties & cross-border transfers

   Non-compliance penalties reach 10% of Brunei annual turnover for organisations with turnover exceeding BND 10 million, or BND 1 million otherwise; criminal sanctions include up to BND 10,000 fine or 3 years imprisonment. Cross-border transfers are addressed via the ASEAN Data Management Framework and Model Contractual Clauses framework.

   agc.gov.bn dlapiperdataprotection.com

Timeline of decisions

1. 1 Jan 2026Law
   Personal Data Protection Order 2025 Enters Full Legal Operation

   After a one-year compliance grace period following its gazetting, the Personal Data Protection Order 2025 (S 1/2025) became fully enforceable, requiring all private-sector organisations and NGOs to meet data-processing obligations or face fines up to BND 1 million (or 10% of annual turnover for large organisations). This is Brunei's first binding, enforced data-privacy regime.

   Rajah & Tann Asia

2. 4 Jun 2025Guidance · official
   AITI publishes Guide for Appointment of Data Protection Officers (v1.0)

   AITI released its first official guidebook on DPO appointment requirements under the PDPO 2025, detailing qualifications, responsibilities, and accountability structures. This is the primary compliance reference for private-sector organisations during the phased implementation.

   AITI (Authority for Info-communications Technology Industry of Brunei Darussalam)

3. 8 Mar 2025Decision · official
   Councils of State session identifies PDPO and data governance as pillars of Brunei's digital economy future

   A formal Councils of State session spotlighted the newly enacted PDPO and the broader Digital Economy Masterplan's data-governance pillar, signalling continued legislative commitment to data-protection reform beyond the PDPO's own grace period.

   Department of Councils of State, Brunei

4. 8 Jan 2025Law · official
   Personal Data Protection Order 2025 gazetted, Brunei's first dedicated data-protection law

   Enacted by Royal approval and gazetted as S 1/2025, the PDPO covers all private-sector and NGO processing of personal data, creates individual rights (consent, access, correction, withdrawal), mandates DPO appointment, and imposes penalties of up to 10 % of annual turnover (or BND 1 million). AITI was designated the Data Protection Authority, with enforcement to begin after a one-year compliance grace period.

   Attorney General's Chambers, Brunei Darussalam

5. 3 Dec 2021Guidance · official
   AITI publishes Response to Feedback on Personal Data Protection consultation

   After reviewing submissions from government agencies, businesses, and civil society, AITI published its consolidated response refining the proposed PDPO's scope, exemptions, and enforcement model. This document shaped the final 2025 Order.

   AITI (Authority for Info-communications Technology Industry of Brunei Darussalam)

6. 20 May 2021Guidance · official
   AITI releases Public Consultation Paper on Personal Data Protection for the Private Sector

   AITI issued a formal consultation paper proposing a comprehensive data-protection framework for private-sector entities, the first structured step toward a dedicated data-protection statute. It sought feedback on core principles, consent mechanisms, enforcement, and an oversight authority.

   AITI (Authority for Info-communications Technology Industry of Brunei Darussalam)

7. 4 Jun 2020Decision · official
   Digital Economy Masterplan 2025 launched, designating data governance as a strategic enabler

   The Ministry of Transport and Infocommunications launched Brunei's first five-year digital economy roadmap, which explicitly identified a Personal Data Protection Order and a Cybersecurity Order as foundational policy outputs needed for the country's Smart Nation vision.

   Ministry of Transport and Infocommunications (MTIC), Brunei

Sources

1. 1.agc.gov.bn/AGC%20Images/LAWS/Gazette_PDF/2025/EN/S%201_2025%20%5BE%5D.pdf
2. 2.pdp.aiti.gov.bn/media/tndpduml/s-1_2025-e.pdf
3. 3.aiti.gov.bn/regulatory/pdp/
4. 4.aiti.gov.bn/guide-books/guide-for-appointment-of-data-protection-officers/
5. 5.thescoop.co/2025/03/08/brunei-enacts-new-law-giving-citizens-control-over-persona
6. 6.dataguidance.com/opinion/brunei-darussalam-personal-data-protection-order
7. 7.dlapiperdataprotection.com/index.html?t=law&c=BN
8. 8.pdp.aiti.gov.bn/media/nvbnfmhz/pcp_personaldataprotectionprivatesector_20052021_final