Brunei

Personal Data Protection Order, 2025, section 2 (definition of 'organisation') and section 7(1)(c)-(d). Section 3(1) removes the duties in Parts 3 to 7 for individuals acting personally or domestically, for employees acting in the course of employment, and — importantly — for any public agency. Section 3(2) gives a data processor working under a written contract a reduced set of duties, but expressly keeps sections 22 (security), 23 (retention) and 24 (transfer) on the processor. Section 3(5) excludes business contact information. Section 3(4) excludes records that have existed for at least 100 years and data about people who have been dead for more than 10 years.

SECTOR BY SECTOR, all checked on 18 August 2026. BANKING — no localisation. The central bank's outsourcing guidelines say a bank should 'in principle' only use suppliers in countries that uphold confidentiality, must not use countries where the regulator's access to information could be blocked, and must tell the regulator if any foreign authority asks to see customer information. Separately, the binding Technology Risk Management Notice makes a bank tell the central bank BEFORE signing any cloud or outsourcing contract that touches a critical system. INSURANCE AND TAKAFUL — the strictest financial gate. Material outsourcing, which expressly includes software-, platform- and infrastructure-as-a-service, data entry, data centres and archival storage, needs an application to the central bank for approval. SECURITIES AND CAPITAL MARKETS — a licence holder must notify the central bank 30 days before outsourcing an important operational function, and internal audit, risk and compliance may only go to its own group. PAYMENTS — checked the Notice on Requirements for Payment Systems. No storage-location rule found. HEALTH — the Ministry of Health forbids its contractors from moving personal data out of Brunei except on privacy-law terms, and requires the overseas recipient to be bound by legally enforceable comparable protection. CRITICAL NATIONAL SYSTEMS — the closest thing Brunei has to a residency rule. The national cyber agency's cloud policy for critical information infrastructure tells owners using a public cloud hosted outside Brunei to keep a physical or logical 'local anchor' inside Brunei. It is guidance, not law, but it sits alongside a Code of Practice that operators are legally required to follow. GOVERNMENT — the privacy law does not apply to public agencies at all. Government systems are hosted domestically through the E-Government National Centre's own data centre and central database service. TELECOM, EDUCATION, GAMING, MAPPING AND DEFENCE — no storage-location rule found, checked 18 August 2026, confidence medium.

Personal Data Protection Order, 2025, section 24. Section 24(1) makes the transfer lawful only 'in accordance with the prescribed requirements'. Section 24(2) lets the Authority exempt a named organisation by written notice; section 24(3)(b) says that notice 'need not be published in the Gazette and may be revoked at any time'; section 24(4) lets the Authority add, vary or revoke conditions at will. The regulator's own plain-language summary describes the duty as not transferring data 'unless there is a similar or better data protection law available', with the alternative of 'contracts with specific instruction on data protection across borders'. We could not locate published regulations setting out the 'prescribed requirements' in detail, which is recorded in the unconfirmed list.

AITI is the Authority for Info-communications Technology Industry of Brunei Darussalam, created in 2001 and long established as the telecoms and broadcasting regulator, so it is not a paper body — but its data protection arm is new. Evidence of activity found on its own site: the dedicated pdp.aiti.gov.bn portal; a Guide for Appointment of Data Protection Officers and a Guide to Developing a Data Protection Management Programme, both dated 4 June 2025; a Certified Information Privacy Manager training programme now on its fourth cohort (10 to 12 February 2026); awareness sessions for the event management industry (24 February 2026) and for a national foundation (16 February 2026); and live breach-report and complaint forms. Evidence of gaps: the frequently asked questions page returns no entries, the guidance library holds only two documents, and the sector-specific advisory guidelines consulted on from 27 to 29 February 2024 and 'targeted to be published in 2025' were still not published on 18 August 2026. The Order also creates a Data Protection Appeal Panel and Appeal Committees; we found no evidence that either has been constituted. Penalties can reach 10 per cent of Brunei turnover for an organisation turning over more than 10 million Brunei dollars (about 7.8 million US dollars) in Brunei, and 1 million Brunei dollars (about 780,000 US dollars) otherwise.

Personal Data Protection Order, 2025, section 23 sets the ceiling. Two quirks sit next to it in section 3(4): the Order does not apply at all to personal data in a record that has existed for at least 100 years, and applies to a dead person's data only for 10 years after death, and then only the disclosure and protection rules. Sector floors we did verify: Ministry of Health contractors must follow the Ministry's retention schedules, must securely dispose of personal data no longer needed, and on contract termination must return or destroy all Ministry data and certify the destruction in writing. Financial institutions must submit an updated list of all information-technology third party arrangements to the central bank within three months of each financial year end, and owners of critical national systems must audit at least once every two years and run a risk assessment at least once a year. Where a keep-it rule and a delete-it rule collide, section 3(6)(b) of the Order resolves it: any other written law wins over the privacy law to the extent of the inconsistency.

Bank clock: Notice on Early Detection of Cyber Intrusion and Incident Reporting (TRS/N-1/2020/1), Amendment No. 1 effective 1 January 2024, paragraphs 4.1 to 4.5 — one hour to notify, two hours to classify, no public statement before classifying, updates at least twice every calendar day until resolved, and a root cause report within 5 working days. Privacy law clock: Personal Data Protection Order, 2025, sections 26 to 28. The three-day clock does not start at discovery; it starts when you conclude the assessment, and section 27 requires that assessment to be 'reasonable and expeditious'. A breach is notifiable if it causes or is likely to cause significant harm, or is of significant scale. A breach confined inside one organisation is deemed not notifiable. Where a supplier suffers the breach, the supplier must tell its customer without undue delay and the customer runs the assessment. Critical systems clock: Cybersecurity Act, Chapter 272, section 16 — failing to report is a criminal offence carrying a fine of up to 100,000 Brunei dollars (about 78,000 US dollars), up to two years in prison, or both.

(1) Section 3(1)(c) of the Order removes all the substantive duties for public agencies. The Ministry of Health has filled that gap by contract instead, imposing privacy-law-style duties on its suppliers. (2) Section 3(6)(b): 'the provisions of any other written law prevail to the extent that any provision of Parts 3, 4, 5, 6 and 7 is inconsistent with the provisions of that other written law'. (3) Section 24(2)-(4). (4) Sections 31, 32 and 33 make unauthorised disclosure, improper use and re-identification of anonymised information criminal offences for individuals, with fines up to 5,000 Brunei dollars (about 3,900 US dollars) and up to two years in prison. Section 48 adds offences for destroying records to defeat an access request and for obstructing the regulator. (5) Section 9 is a standalone rule for Brunei telephone numbers that overrides the normal consent routes in section 8. Two further snares worth knowing: a data processor working under a written contract is exempt from most duties but NOT from the security, retention and transfer duties, so an outsourcer cannot hide behind its customer; and a bank is forbidden from announcing an incident publicly until it has classified it for the central bank, which cuts across most global incident communication playbooks.

DORMANT SWITCHES — powers already held that could change the picture with no consultation. (1) Section 1(1)-(2) of the Order lets the Minister bring any remaining provision into operation on any date, and different dates for different provisions, by a gazette notice. (2) Section 3(1)(d) lets the government carve out whole classes of organisations or data by regulation. (3) Section 58 lets the Authority make regulations prescribing the transfer requirements, the categories of data that automatically make a breach serious, and the number of affected people that makes a breach large — none of which we could find published, so the practical shape of the transfer and breach rules can be redrawn overnight. (4) Section 24(2) exemptions can be granted and revoked privately. (5) Under the Cybersecurity Act, the Commissioner can designate any computer or computer system located wholly or partly in Brunei as critical information infrastructure by written notice, which immediately switches on audits, annual risk assessments, incident reporting and the cloud restrictions; the Commissioner can also issue binding written directions and emergency measures.