Data protection & privacy law in Brunei (2026)

AITI released its first official guidebook on DPO appointment requirements under the PDPO 2025, detailing qualifications, responsibilities, and accountability structures. This is the primary compliance reference for private-sector organisations during the phased implementation.

A formal Councils of State session spotlighted the newly enacted PDPO and the broader Digital Economy Masterplan's data-governance pillar, signalling continued legislative commitment to data-protection reform beyond the PDPO's own grace period.

Enacted by Royal approval and gazetted as S 1/2025, the PDPO covers all private-sector and NGO processing of personal data, creates individual rights (consent, access, correction, withdrawal), mandates DPO appointment, and imposes penalties of up to 10 % of annual turnover (or BND 1 million). AITI was designated the Data Protection Authority, with enforcement to begin after a one-year compliance grace period.

Brunei's first comprehensive cybersecurity statute (later codified as Chapter 272) established mandatory obligations for critical-information-infrastructure owners, empowered Cyber Security Brunei (CSB) to conduct audits and issue binding directions, and created breach-reporting duties. It is a key complement to the PDPO's data-security obligations.

After reviewing submissions from government agencies, businesses, and civil society, AITI published its consolidated response refining the proposed PDPO's scope, exemptions, and enforcement model. This document shaped the final 2025 Order.

AITI issued a formal consultation paper proposing a comprehensive data-protection framework for private-sector entities, the first structured step toward a dedicated data-protection statute. It sought feedback on core principles, consent mechanisms, enforcement, and an oversight authority.

The Ministry of Transport and Infocommunications launched Brunei's first five-year digital economy roadmap, which explicitly identified a Personal Data Protection Order and a Cybersecurity Order as foundational policy outputs needed for the country's Smart Nation vision.

The 2000 Computer Misuse Act (S 65/00) was consolidated and updated as Chapter 194 of the Laws of Brunei, retaining criminal offences for unauthorised computer access, data modification, interception, and obstruction, providing the baseline for data-security enforcement prior to the PDPO.

BruCERT was created as the national government CERT to coordinate detection, analysis, and prevention of cybersecurity incidents. It became the central hub for international CERT liaison and set the operational foundation for what later became Cyber Security Brunei.

Based on the UNCITRAL Model Law on Electronic Commerce, this Order granted legal recognition to electronic records and digital signatures, enabling secure digital transactions and establishing foundational rules for data authenticity that underpin later data-governance obligations.