Law: There is no general personal data protection law.

Regulator: There is no data protection authority.

Summary: No specific data protection legislation has been adopted in Brunei yet. However, on May 20, 2021, the Authority for Info-Communications Technology Industry of Brunei Darussalam (AITI) published its public consultation of the proposed Personal Data Protection Order (PDPO) which would introduce a comprehensive data protection regime for Brunei. Moreover, a response feedback paper on the public consultation was published by the AITI, on December 3, 2021.

In its current envisioned format, the PDPO aims to establish a comprehensive data protection regime that encompasses data protection principles, requirements for organizations, data subject rights, and investigatory as well as enforcement powers of the data protection authority. Furthermore, AITI would act as the supervisory authority for enforcing and administrating all data protection regulations and laws. The next steps for the AITI is to introduce a finalized draft for commencement and the signing of the draft into the Gazette by His Majesty the Sultan of Brunei Darussalam.