Online safety & content laws in Brunei (2026)

After a one-year compliance grace period following its gazetting, the Personal Data Protection Order 2025 (S 1/2025) became fully enforceable, requiring all private-sector organisations and NGOs to meet data-processing obligations or face fines up to BND 1 million (or 10% of annual turnover for large organisations). This is Brunei's first binding, enforced data-privacy regime.

AITI, jointly with the Prime Minister's Office, Ministry of Transport and Infocommunications, and the Royal Brunei Police Force, launched Waspada.bn via Instagram to let the public verify social-media information and report digital scams. The platform is the first coordinated multi-agency anti-misinformation tool in Brunei and is slated to expand into a full website by early 2026.

His Majesty the Sultan approved and published Brunei's first comprehensive data-protection statute, establishing rights over personal data collection, use, and disclosure by private entities, with AITI designated as the enforcement authority. A one-year grace period was built in to allow organisations time to comply before enforcement began on 1 January 2026.

The Cybersecurity Order (S 20/2023), later codified as the Cybersecurity Act Chapter 272 in 2024, created the legal framework for protecting Critical Information Infrastructure (CII) across 10 essential-service sectors including info-communications, healthcare, banking, and media. Cyber Security Brunei (CSB), under the Ministry of Transport and Infocommunications, was designated the national cybersecurity authority with powers to mandate audits, incident reporting, and remediation.

A Brunei court convicted Shahiransheriffuddin bin Shahrani Muhammad in absentia to 18 months' imprisonment under Section 4(1)(c) of the Sedition Act for a 2017 Facebook post criticising the Ministry of Religious Affairs' halal-certification regulation. The case confirmed that social-media commentary critical of government policy can attract criminal sedition charges and set a chilling-effect precedent for online expression.

The third and final phase of the Syariah Penal Code Order brought hudud penalties into force, including death by stoning for blasphemy and apostasy. Because the provisions apply to any 'statement or publication,' they expressly cover online and social-media content, making Brunei's legal environment for digital religious expression one of the most restrictive in Southeast Asia.

The Authority for Info-communications Technology Industry (AITI) began operations as the statutory body responsible for licensing ISPs, managing radio-frequency spectrum, and advising content providers to remove material contrary to public interest and national morals. AITI became the operational centre of Brunei's internet governance, sitting under the Ministry of Transport and Infocommunications.

The Telecommunications Order 2001 established the comprehensive legal and institutional framework for licensing all telecommunications and internet service providers in Brunei, granting the new regulatory authority (subsequently formalised as AITI) exclusive oversight powers including content conditions, interconnection rules, and spectrum management. It remains the primary statute governing ISP market access.

Under the Broadcasting Act (Chapter 180), this notification made all ISPs and Internet Content Providers subject to a mandatory Code of Practice requiring them to monitor and remove content contrary to public interest, national harmony, and social morals. It was the first binding content-moderation obligation placed on internet intermediaries in Brunei, establishing a model of proactive ISP liability for online content.

Brunei's first dedicated cybercrime statute criminalised unauthorised access to and modification of computer material, interception of computer services, and obstruction of computer use. The Act equipped law enforcement with search, seizure, and production-order powers equivalent to those for physical crime, forming the bedrock of Brunei's online enforcement capability.

The Electronic Transactions Act provided legal recognition for electronic records, signatures, and contracts, anchoring Brunei's digital-economy and e-commerce regulatory foundation. By legitimising digital communications as legally enforceable instruments, it also established the legal basis for regulating and adjudicating online conduct.