The framework
Brunei's framework rests on the Personal Data Protection Order, 2025, with the AITI as the supervisory authority.
That puts Brunei in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Personal Data Protection Order, 2025
Brunei's first private-sector data protection law, the Personal Data Protection Order 2025, was enacted in January 2025, and most of its substantive duties have applied since 1 January 2026. It is closely modeled on Singapore's PDPA and enforced by AITI; government processing sits outside it.
Marketing and advertising
Singapore-modeled consent framework for the private sector, with deemed consent concepts. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad need comparable protection at the destination.
Enforcement and penalties
Financial penalties up to 10% of local turnover or BND 1M for larger firms.