Brunei

The law is the Personal Data Protection Order, 2025. Section 2 says an organisation is any person or body, wherever it was set up and wherever it is based. Section 7 requires you to name a data protection officer and publish their work contact details. Section 3 then removes most duties for several groups. Individuals acting for themselves or at home are out. So are employees acting for their employer. So is any government body. A supplier working under a written contract gets a shorter list of duties. But it must still keep data secure, stop keeping it when the purpose is done, and follow the rules on sending it abroad. Work contact details sit outside the law. So do records that are at least 100 years old. So does data about someone who has been dead for more than 10 years.

Checked industry by industry on 18 August 2026. BANKING. Data does not have to stay in Brunei. The central bank's outsourcing guidelines say a bank should 'in principle' only use suppliers in countries that keep information confidential. A bank must not use a country where the regulator could be blocked from getting information. A bank must also tell the regulator if a foreign authority asks to see customer information. A separate binding notice on technology risk adds a step. A bank must tell the central bank before it signs any cloud or outsourcing contract that touches a critical system. INSURANCE AND TAKAFUL (ISLAMIC INSURANCE). This is the strictest financial gate. Outsourcing anything the rules count as material needs an application to the central bank for approval. That expressly includes software, platform and infrastructure as a service, data entry, data centres and archival storage. SECURITIES AND CAPITAL MARKETS. A licence holder must tell the central bank 30 days before outsourcing an important operational function. Internal audit, risk and compliance work may only go to its own corporate group. PAYMENTS. We checked the Notice on Requirements for Payment Systems. We found no rule about where data must be stored. HEALTH. The Ministry of Health bans its contractors from moving personal data out of Brunei. The only exception is a move that meets the privacy law's terms. The overseas recipient must also be legally bound to give comparable protection. CRITICAL NATIONAL SYSTEMS. This is the closest Brunei gets to a rule about keeping data in the country. The national cyber agency's cloud policy covers systems the government has labelled critical. If the owner uses a public cloud hosted outside Brunei, it is told to keep a physical or logical 'local anchor' inside Brunei. That is guidance, not law. But it sits next to a Code of Practice that these owners must follow by law. GOVERNMENT. The privacy law does not apply to government bodies at all. Government systems are hosted inside Brunei through the E-Government National Centre's own data centre and central database service. TELECOM, EDUCATION, GAMING, MAPPING AND DEFENCE. We found no rule about where data must be stored. Checked 18 August 2026. Confidence medium.

The rule is section 24 of the Personal Data Protection Order, 2025. A transfer is lawful only if it meets 'the prescribed requirements'. The Authority can exempt a named organisation by written notice. That notice 'need not be published in the Gazette and may be revoked at any time'. The Authority can also add, change or cancel conditions whenever it likes. The regulator's own plain-language summary puts the duty simply. Do not transfer data unless there is a similar or better data protection law where it is going. The alternative it gives is 'contracts with specific instruction on data protection across borders'. We could not find published regulations setting out the prescribed requirements in detail. That gap is in the unconfirmed list.

AITI is the Authority for Info-communications Technology Industry of Brunei Darussalam. It was created in 2001 and has long been the telecoms and broadcasting regulator. It is a real, staffed body. Its data protection arm is new. Signs of activity on its own site. It runs a dedicated portal at pdp.aiti.gov.bn. It published a Guide for Appointment of Data Protection Officers and a Guide to Developing a Data Protection Management Programme. Both are dated 4 June 2025. It runs a Certified Information Privacy Manager training programme, now on its fourth cohort, held 10 to 12 February 2026. It ran awareness sessions for the event management industry on 24 February 2026. It ran another for a national foundation on 16 February 2026. Its breach-report and complaint forms work. Signs of gaps. The frequently asked questions page returns no entries. The guidance library holds only two documents. The industry-specific advisory guidelines are still missing. Those were consulted on from 27 to 29 February 2024 and were 'targeted to be published in 2025'. They were still not published on 18 August 2026. The Order also creates a Data Protection Appeal Panel and Appeal Committees. We found no evidence that either has been set up. Fines can reach 10 per cent of Brunei turnover. That applies to an organisation turning over more than 10 million Brunei dollars (about 7.8 million US dollars) in Brunei. For everyone else the cap is 1 million Brunei dollars (about 780,000 US dollars).

Section 23 of the Personal Data Protection Order, 2025 sets the upper limit. Two oddities sit next to it in section 3(4). The Order does not apply at all to personal data in a record that is at least 100 years old. It applies to a dead person's data for only 10 years after death, and then only the disclosure and protection rules. Some minimum keeping periods we did confirm. Ministry of Health contractors must follow the Ministry's retention schedules. They must securely destroy personal data they no longer need. When a contract ends they must return or destroy all Ministry data and certify the destruction in writing. Financial firms must send the central bank an updated list of all technology arrangements with outside firms within three months of each financial year end. Owners of critical national systems must audit at least once every two years and run a risk assessment at least once a year. Sometimes a keep-it rule and a delete-it rule clash. Section 3(6)(b) of the Order settles it. Any other written law wins over the privacy law where the two disagree.

Bank clock. Notice on Early Detection of Cyber Intrusion and Incident Reporting (TRS/N-1/2020/1), Amendment No. 1, effective 1 January 2024, paragraphs 4.1 to 4.5. One hour to tell the central bank. Two hours to classify the incident. No public statement before classifying. Updates at least twice every calendar day until it is resolved. A root cause report within 5 working days. Privacy law clock. Personal Data Protection Order, 2025, sections 26 to 28. The three-day clock does not start when you find the breach. It starts when you finish your assessment. Section 27 requires that assessment to be 'reasonable and expeditious'. You must report a breach if it causes or is likely to cause significant harm, or if it is of significant scale. A breach that stays inside one organisation is treated as not reportable. If your supplier suffers the breach, it must tell you without undue delay. You then run the assessment. Critical systems clock. Cybersecurity Act, Chapter 272, section 16. Failing to report is a crime. It carries a fine of up to 100,000 Brunei dollars (about 78,000 US dollars), up to two years in prison, or both.

(1) Section 3(1)(c) of the Order removes the main duties for public agencies. The Ministry of Health has filled that gap by contract instead. It puts privacy-law-style duties on its suppliers. (2) Section 3(6)(b) says any other written law wins where Parts 3, 4, 5, 6 and 7 of the Order disagree with it. (3) The private exemption power sits in section 24(2) to (4). (4) Sections 31, 32 and 33 create three crimes for individuals. Disclosing personal data without permission. Misusing it. And working out who anonymised information belongs to. Fines run up to 5,000 Brunei dollars (about 3,900 US dollars), with up to two years in prison. Section 48 adds crimes for destroying records to defeat an access request and for obstructing the regulator. (5) Section 9 is a standalone rule for Brunei telephone numbers. It overrides the normal consent routes in section 8. Two more traps are worth knowing. A supplier working under a written contract escapes most duties. It does not escape the duties on security, on how long it keeps data, or on sending data abroad. So an outsourcer cannot hide behind its customer. And a bank must not announce an incident publicly until it has classified it for the central bank. That cuts across most global incident communication plans.

Powers the government already holds. Each could change the answer with no consultation. (1) Section 1(1)-(2) of the Order lets the Minister switch on any remaining part of the law by a gazette notice. He can pick any date, and different dates for different parts. (2) Section 3(1)(d) lets the government exempt whole classes of organisations or data by regulation. (3) Section 58 lets the Authority make regulations. Those would set the transfer requirements. They would also set which kinds of data automatically make a breach serious, and how many affected people make a breach large. We could not find any of them published. So the working shape of the transfer and breach rules could be redrawn overnight. (4) Section 24(2) exemptions can be granted and cancelled in private. (5) Under the Cybersecurity Act, the Commissioner can label a computer or computer system as critical information infrastructure, by written notice. The system must be located wholly or partly in Brunei. That immediately switches on audits, annual risk assessments, incident reporting and the cloud restrictions. The Commissioner can also issue binding written directions and emergency measures.