Brunei Personal Data Protection Order 2022 (PDPO)

Brunei Darussalam

v2022

7 domains

31 controls

The Personal Data Protection Order (PDPO) 2022, issued under the Emergency (Prohibition of Certain Acts) Order, establishes a comprehensive data protection framework for Brunei Darussalam. The Authority for Info-communications Technology Industry (AITI) is designated as the data protection authority responsible for enforcement and compliance. The PDPO aligns with the APEC Privacy Framework, setting out obligations for data controllers, rights for data subjects, and enforcement mechanisms.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Brunei PDPO Part 1-2: Preliminary and Administration

4 controls

Controls in the Brunei PDPO Part 1-2: Preliminary and Administration domain of Brunei Personal Data Protection Order 2022 (PDPO) — 4 controls
Code	Title	Description
BN-PDPO-s2	Interpretation	Interpretation. Section 2 defines the terms used in the Order (personal data, organisation, data subject/individual, pro...
BN-PDPO-s3	Application of Order	Application. Section 3 sets out to whom and what processing the Order applies, including any exclusions and the treatmen...
BN-PDPO-s4	Administration of the Order (the Authority)	Administration. Section 4 designates the Authority (AITI) responsible for administering the Order.
BN-PDPO-s5	Functions and duties of the Authority	Functions of the Authority. Section 5 sets out the functions and duties of the Authority, including supervision, guidanc...

Brunei PDPO Part 10-12: Offences, Enforcement and Remedies

7 controls

Controls in the Brunei PDPO Part 10-12: Offences, Enforcement and Remedies domain of Brunei Personal Data Protection Order 2022 (PDPO) — 7 controls
Code	Title	Description
BN-PDPO-s31	Unauthorised disclosure of personal data	Unauthorised disclosure. Section 31 makes it an offence for a person to knowingly or recklessly disclose personal data i...
BN-PDPO-s32	Improper use of personal data	Improper use. Section 32 makes it an offence to make use of personal data to obtain a gain or cause harm in contraventio...
BN-PDPO-s33	Unauthorised re-identification of anonymised information	Re-identification. Section 33 makes it an offence to re-identify anonymised information without authorisation.
BN-PDPO-s36	Directions for non-compliance	Directions. Section 36 empowers the Authority to give directions to an organisation to ensure compliance with the Order.
BN-PDPO-s37	Financial penalties	Financial penalties. Section 37 empowers the Authority to impose financial penalties for non-compliance, up to the presc...
BN-PDPO-s42	Appeal from direction or decision of the Authority	Appeals. Section 42 provides a right of appeal from a direction or decision of the Authority to the Data Protection Appe...
BN-PDPO-s59	Right of private action	Private action. Section 59 gives an individual who suffers loss or damage from a contravention of the Order a right of p...

Brunei PDPO Part 3: Accountability

1 controls

Controls in the Brunei PDPO Part 3: Accountability domain of Brunei Personal Data Protection Order 2022 (PDPO) — 1 controls
Code	Title	Description
BN-PDPO-s7	Responsibilities of organisation (accountability)	Accountability. Section 7 sets the responsibilities of an organisation for personal data in its possession or control, i...

Brunei PDPO Part 4: Consent

6 controls

Controls in the Brunei PDPO Part 4: Consent domain of Brunei Personal Data Protection Order 2022 (PDPO) — 6 controls
Code	Title	Description
BN-PDPO-s10	Valid consent	Valid consent. Section 10 sets the conditions for consent to be valid (informed, given by the individual, not obtained t...
BN-PDPO-s11	Deemed consent	Deemed consent. Section 11 sets the circumstances in which an individual is deemed to consent to the collection, use or...
BN-PDPO-s13	Withdrawal of consent	Withdrawal of consent. Section 13 gives individuals the right to withdraw consent and requires organisations to cease th...
BN-PDPO-s14	Collection, use and disclosure without consent	Without consent. Section 14 sets out the situations in which personal data may be collected, used or disclosed without c...
BN-PDPO-s8	Consent required	Consent required. Section 8 requires consent for the collection, use or disclosure of personal data unless otherwise per...
BN-PDPO-s9	Consent for direct marketing messages	Direct marketing. Section 9 sets the consent requirements for sending direct marketing messages to recipients in Brunei...

Brunei PDPO Part 5-6: Purpose, Notification, Access and Correction

5 controls

Controls in the Brunei PDPO Part 5-6: Purpose, Notification, Access and Correction domain of Brunei Personal Data Protection Order 2022 (PDPO) — 5 controls
Code	Title	Description
BN-PDPO-s15	Limitation of purpose and extent	Purpose limitation. Section 15 limits the collection, use and disclosure of personal data to purposes a reasonable perso...
BN-PDPO-s17	Notification of purpose	Notification. Section 17 requires organisations to notify the individual of the purposes for collection, use or disclosu...
BN-PDPO-s18	Access to personal data	Right of access. Section 18 gives individuals the right to request access to their personal data and information about i...
BN-PDPO-s19	Correction of personal data	Right of correction. Section 19 gives individuals the right to request correction of an error or omission in their perso...
BN-PDPO-s20	Exercise of rights on behalf of an individual	Representation. Section 20 sets out how rights under the Order may be exercised on behalf of an individual (e.g. by a pe...

Brunei PDPO Part 7: Care of Personal Data

4 controls

Controls in the Brunei PDPO Part 7: Care of Personal Data domain of Brunei Personal Data Protection Order 2022 (PDPO) — 4 controls
Code	Title	Description
BN-PDPO-s21	Accuracy of personal data	Accuracy. Section 21 requires organisations to make a reasonable effort to ensure personal data collected is accurate an...
BN-PDPO-s22	Protection of personal data	Protection. Section 22 requires organisations to protect personal data by making reasonable security arrangements to pre...
BN-PDPO-s23	Retention of personal data	Retention. Section 23 requires organisations to cease retention of personal data when the purpose is no longer served an...
BN-PDPO-s24	Transfer of personal data outside Brunei Darussalam	Cross-border transfer. Section 24 requires that personal data transferred outside Brunei Darussalam receive a standard o...

Brunei PDPO Part 8-9: Data Breach Notification and Public Agency Processors

4 controls

Controls in the Brunei PDPO Part 8-9: Data Breach Notification and Public Agency Processors domain of Brunei Personal Data Protection Order 2022 (PDPO) — 4 controls
Code	Title	Description
BN-PDPO-s26	Notifiable data breaches	Notifiable data breaches. Section 26 defines the data breaches that are notifiable (those resulting in or likely to resu...
BN-PDPO-s27	Duty to conduct assessment of a data breach	Breach assessment. Section 27 requires organisations to conduct a prompt assessment to determine whether a data breach i...
BN-PDPO-s28	Duty to notify a notifiable data breach	Breach notification. Section 28 requires organisations to notify the Authority (and affected individuals where required)...
BN-PDPO-s29	Obligations of a data processor of a public agency	Public-agency processors. Section 29 sets the obligations of organisations acting as data processors for public agencies...

Maps to 2 other frameworks

31 total controls

GDPR

5 source controls mapped|5 target controls covered

16%

PDPA Singapore

4 source controls mapped|4 target controls covered

13%

Compare Brunei Personal Data Protection Order 2022 (PDPO) with GDPR

Frequently Asked Questions

What is Brunei Personal Data Protection Order 2022 (PDPO)?

Brunei Personal Data Protection Order 2022 (PDPO) is a compliance framework from Brunei Darussalam with 7 domains and 31 controls. The Personal Data Protection Order (PDPO) 2022, issued under the Emergency (Prohibition of Certain Acts) Order, establishes a comprehensive data protection framework for Brunei Darussalam. The Authority for Info-communications Technology Industry (AITI) is designated as the data protection authority responsible for enforcement and compliance. The PDPO aligns with the APEC Privacy Framework, setting out obligations for data controllers, rights for data subjects, and enforcement mechanisms. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Brunei Personal Data Protection Order 2022 (PDPO) have?

Brunei Personal Data Protection Order 2022 (PDPO) has 31 controls organised across 7 domains. The largest domains are Brunei PDPO Part 10-12: Offences, Enforcement and Remedies (7 controls), Brunei PDPO Part 4: Consent (6 controls), Brunei PDPO Part 5-6: Purpose, Notification, Access and Correction (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Brunei Personal Data Protection Order 2022 (PDPO) map to?

Brunei Personal Data Protection Order 2022 (PDPO) maps to 2 other compliance frameworks. The top mapping partners are GDPR (16% coverage), PDPA Singapore (13% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with Brunei Personal Data Protection Order 2022 (PDPO) compliance?

Start your Brunei Personal Data Protection Order 2022 (PDPO) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Brunei Personal Data Protection Order 2022 (PDPO) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required