Personal Data Protection Order, 2025

Different dates may be appointed under subsection (1) for provisions of this Order or for different purposes of the same provisions.

The long title of this Order is "An Order to govern the collection, use and disclosure of personal data by organisations and for matters connected therewith".

provides credit reports on a routine, non-profit basis as an ancillary part of a business carried on for gain or profit;

"credit report" means a communication, whether in written, oral or other form, provided to an organisation to assess the creditworthiness of an individual in relation to a transaction between the organisation and the individual;

"data processor" means an organisation which processes personal data on behalf of another organisation or public agency;

"direct marketing message" means a message, whether in sound, text, visual or other form, containing advertising or marketing material of a commercial nature which is directed to a particular individual;

"education institution" means any organisation that provides education, including instruction, training or teaching, whether by itself or in association or collaboration with or by affiliation with any other person;

"employee" has the same meaning assigned to it under the Employment

Order, 2009 (S 37/2009) and includes a volunteer;

"employment" includes working under an unpaid volunteer work relationship;

10

11 8th. JANUARY, 2025

"evaluative purpose" means-fa} for the purpose of determining the suitability, eligibility or qualifications of the individual to whom the data relates -

for employment or for appointment to office;

for the awarding of contracts, awards, bursaries, scholarships, honours or other similar benefits;

for the purpose of determining whether any contract, award, bursary, scholarship, honour or other similar benefit should be continued, modified or cancelled;

for the purpose of deciding whether to insure any individual or property or to continue or renew the insurance of any individual or property; or

for such other similar purposes as the Authority may determine;

"individual" means a natural person, whether living or deceased;

"investigation" means an investigation relating to -

fa} a breach of an agreement;

fb} a contravention of any written law or any rule of professional conduct or other requirement imposed by any regulatory authority in exercise of its powers under any written law; or

{cj a circumstance or conduct that may result in a remedy or relief being available under any written law;

"Minister" means the Minister responsible for personal data protection;

"national interest" includes national defence, national security, public security, the maintenance of essential services and the conduct of international affairs;

"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not-

(a} formed or recognised under the law of Brunei Darussalam; or

(bJ resident, or having an office or a place of business, in Brunei

Darussalam;

"personal data" means data, whether true or not, about an individual who can be identified -

(a} from that data; or

(bJ from that data and other information to which the organisation has or is likely to have access;

"prescribed healthcare body", for the purposes of Schedule 2, means a healthcare body declared by the Minister of Health, by notification published in the Gazette;

"prescribed law enforcement agency", for the purposes of sections 18(4)

and 28(6){aj and Schedule 2, means a relevant authority charged with the duty of investigating offences or charging offenders under any written law, declared by the relevant Minister responsible for that authority, by notification published in the Gazette;

"private trust" means a trust for the benefit of one or more designated individuals who are friends, or members of the family, of the settlor;

"proceedings" means any civil, criminal or administrative proceedings by or before a court, tribunal or regulatory authority that is related to the allegation of -

(aJ a breach of an agreement;

12

13 8th. JANUARY, 2025

a contravention of any written law or any rule of professional conduct or other requirement imposed by any regulatory authority in exercise of its powers under any written law; or

a wrong or a breach of a duty for which a remedy is claimed under any law;

"processing", in relation to personal data, means the carrying out of any operation or set of operations in relation to the personal data, and includes any of the following -

(a} collection;

recording;

holding or storage;

organisation, structuring, adaptation or alteration;

retrieval;

(fJ alignment or combination;

use;

disclosure by transmission, dissemination or otherwise making available;

(i}

erasure or destruction;

"public agency" includes -

(a} the Government, including any ministry, department, agency, or organ of State;

any tribunal appointed under any written law; or

any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;

"publicly available", in relation to personal data about an individual, means personal data that is generally available to the public, and includes personal

BRUNEI DARUSSALAM GOVERNMENT GAZETTE data which can be observed by reasonably expected means at a location or an event-

(a} at which the individual appears; and

(b} that is open to the public.

Parts 3, 4, 5, 6 and 7 do not impose any obligation on-

(a} any individual acting in a personal or domestic capacity;

Parts 3, 4, 5, 6 (except sections 22, 23 and 24) and 7 (except sections 27(2)(a} and 29) do not impose any obligation on a data processor in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing.

An organisation has the same obligation under this Order in respect of personal data processed on its behalf and for its purposes by a data processor as if the personal data were processed by the organisation itself.

This Order does not apply in respect of-

(a} personal data about an individual that is contained in a record that has been in existence for at least 100 years; or

Except where business contact information is expressly referred to,

Parts 3, 4, 5, 6 and 7 do not apply to business contact information.

Unless otherwise expressly provided in this Order-

(a} nothing in Parts 3, 4, 5, 6 and 7 affects any authority, right, privilege or immunity conferred, or obligation or limitation imposed, by or under the law, including legal privilege, except that the performance of a contractual obligation is not an excuse for contravening this Order; and

The Authority may appoint such number of authorised officers to carry into effect any specific provision of this Order or of any regulations made thereunder.

It shall be the function and duty of the Authority-

15

(a} to promote awareness of data protection in Brunei Darussalam;

Nothing in this section is construed as imposing on the Authority, directly or indirectly, any form of duty or liability enforceable by proceedings before any court.

The Authority may consult such advisory committees in relation to the performance of its functions and duties and the exercise of its powers under this

Order but is not bound by the consultation.

ACCOUNTABILITY FOR PERSONAL DATA

the nature, scope and context of, and purposes for, the organisation's collection, use or disclosure of personal data;

and

develop and implement policies and practices that are necessary for the organisation to meet the obligations of the organisation under this Order;

the policies and practices referred to in sub-paragraph (i);

the complaint process referred to in sub-paragraph (ii).

Without limiting subsection (l)(d}, an organisation is deemed to have satisfied subsection (l)(d} if the organisation makes available the business contact information of any individual mentioned in subsection (l)(c} in any prescribed manner.

The designation of an individual by an organisation under subsection

An individual has not given consent under this Order for the collection, use or disclosure of personal data about the individual by an organisation for a purpose unless -

(a} the individual has been provided with the information required under section 17; and

(b} the individual provided his consent for that purpose in accordance with this Order.

An individual has not given clear and unambiguous consent under this

Order for the use of his Brunei Darussalam telephone number for the purpose of receiving a direct marketing message unless -

(a} the individual has been provided with the information required under section 17;

(b} the individual provided his consent for that purpose in accordance with this Order; and

No organisation shall -

Any consent given in any of the circumstances in subsection (3) is not validly given for the purposes of this Order.

the individual, without actually giving consent referred to in section 10, voluntarily provides the personal data to the organisation for that purpose; and

it is reasonable that the individual would voluntarily provide the data.

If an individual gives, or is deemed to have given, consent to the disclosure of personal data about the individual by one organisation to another organisation for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal data for that particular purpose by that other organisation.

Without limiting subsection (2) and subject to subsection (7), an individual (P} who provides personal data to an organisation (A) with a view to P entering into a contract with A is deemed to consent to the following -

19

(a} the disclosure of that personal data by A to another organisation (B), where the disclosure is reasonably necessary for the conclusion of the contract between PandA;

Where an organisation collects personal data disclosed to it by B under subsection (3){c}, subsection (3){b} and {c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (3){a}.

Without limiting subsection (2) and subject to subsection (7), an individual {P} who enters into a contract with an organisation {A} and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following -

fa} the disclosure of that personal data by A to another organisation {B), where the disclosure is reasonably necessary-

Where an organisation collects personal data disclosed to it by B under subsection (5){c}, subsection (5){b} and {c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (5)(a}.

Subsections (3), (4), (5) and (6) do not affect any obligation under the contract between P and A that specifies or restricts -

{a} the personal data provided by P that A may disclose to another organisation; or

{b) the purposes for which A may disclose the personal data provided by P to another organisation.

Subject to subsection (2), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if -

(a} the organisation satisfies the requirements in subsection (3); and

Subsection (1) does not apply to the collection, use or disclosure of personal data about the individual for the purpose of sending a direct marketing message.

For the purposes of subsection (1)(a}, the organisation shall, before collecting, using or disclosing any personal data about the individual -

21

(a} conduct an assessment to determine that the proposed collection, use or disclosure of the personal data is not likely to have an adverse effect on the individual; and

The organisation shall, in respect of the assessment mentioned m subsection (3){a}-

fa} identify any adverse effect that the proposed collection, use or disclosure of the personal data for the relevant purpose is likely to have on the individual;

{b) identify and implement reasonable measures -

On receipt of the notice referred to in subsection (1), the organisation concerned shall inform the individual of the likely consequences of withdrawing his consent.

No organisation shall prohibit an individual from withdrawing his consent to the collection, use or disclosure of personal data about the individual, but this section does not affect any legal consequences arising from such withdrawal.

Subject to section 23, if an individual withdraws consent to the collection, use or disclosure of personal data about the individual by an organisation for any purpose, the organisation shall cease (and cause its data processors and agents to cease) collecting, using or disclosing the personal data, unless such collection, use or disclosure without the consent of the individual is required or authorised under this Order or any other written law.

An organisation may-

{a} collect personal data about an individual, without the consent of the individual or from a source other than the individual, in the 22

circumstances or for the purposes, and subject to any condition, in

Schedule 1 or Part 1 of Schedule 2;

{b} use personal data about an individual without the consent of the individual, in the circumstances or for the purposes, and subject to any condition, in Schedule 1 or Part 2 of Schedule 2; or

{c} disclose personal data about an individual without the consent of the individual, in the circumstances or for the purposes, and subject to any condition, in Schedule 1 or Part 3 of Schedule 2.

Unless otherwise provided under this Order, an organisation may-

{a} collect personal data about an individual that is disclosed to the organisation in accordance with subsection (1){c} for purposes consistent with the purpose of that disclosure; or

{b} use or disclose personal data about an individual that is collected by the organisation in accordance with subsection (1){a} for purposes consistent with the purpose of that collection.

Notwithstanding the other provisions in this Part, an organisation may use personal data about an individual collected before the date of commencement of this Order for the purposes for which the personal data was collected unless -

23

fa} consent for such use is withdrawn in accordance with section 13; or

{b} the individual, whether before, on or after the date of commencement of this Order, has otherwise indicated to the organisation that he opts-out or otherwise does not consent to the use of the personal data.

No organisation shall use a Brunei Darussalam telephone number of the individual for the purpose of sending a direct marketing message unless the organisation has given the individual a reasonable opportunity to opt-out from receiving the direct marketing message.

An organisation may collect, use or disclose personal data about an individual only for purposes that the individual has been informed of under subsection (2), if applicable.

For the purposes of section 10(1){a} and subsection (1), an organisation shall inform the individual of -

fa} the purposes for the collection, use or disclosure of the personal data on or before collecting the personal data;

{b} any other purpose of the use or disclosure of the personal data of which the individual has not been informed under paragraph {a}, before the use or disclosure of the personal data for that purpose; and

{c} on request by the individual, the business contact information of a person who is able to answer on behalf of the organisation the individual's questions about the collection, use or disclosure of the personal data.

An organisation, on or before collecting personal data about an individual from another organisation without the consent of the individual, shall provide the other organisation with sufficient information regarding the purpose of the collection to allow that other organisation to determine whether the disclosure would be in accordance with this Order.

Subsection (2) does not apply if-fa} the individual is deemed to have consented to the collection, use or disclosure under section 11 or 12; or

{b} the organisation collects, uses or discloses the personal data without the consent of the individual in accordance with section 14.

Notwithstanding subsection (4), an organisation shall comply with subsection (6) on or before collecting, using or disclosing personal data about an individual for the purpose of or in relation to the organisation -

fa} entering into an employment relationship with the individual or appointing the individual to any office; or

(b} managing or terminating the employment relationship with or appointment of the individual.

For the purposes of subsection (5), the organisation shall inform the individual of the following -

fa} the purpose for which the organisation IS collecting, using or disclosing the personal data about the individual;

(b} on request by the individual, the business contact information of a person who is able to answer the individual's questions about that collection, use or disclosure on behalf of the organisation.

RIGHTS OF INDIVIDUALS

Subject to subsections (2), (3) and (4), on request of an individual, an organisation shall, as soon as reasonably possible, provide the individual with-fa} personal data about the individual that is in the possession or under the control of the organisation; and

(b} information about the ways in which the personal data referred to in paragraph fa} has been or may have been used or disclosed by the organisation within a year before the date of the request.

An organisation is not required to provide an individual with the individual's personal data or other information under subsection (1) in respect of the matters specified in Schedule 3.

No organisation shall provide an individual with the individual's personal data or other information under subsection ( 1) if the provision of that personal data or other information could reasonably be expected to -

25

(aJ threaten the safety or physical or mental health of an individual other than the individual who made the request;

(bJ cause immediate or grave harm to the safety or to the physical or mental health of the individual who made the request;

(cJ reveal personal data about another individual;

(dJ reveal the identity of an individual who has provided personal data about another individual and the individual providing the personal data does not consent to the disclosure of his identity; or

(eJ be contrary to the national interest.

No organisation shall inform any individual under subsection ( 1){bJ that the organisation has disclosed personal data about the individual to a prescribed law enforcement agency if the disclosure was made without the consent of the individual under this Order or any other written law.

If an organisation is able to provide the individual with the individual's personal data and other information requested under subsection ( 1) without the personal data or other information excluded under subsections (2), (3) and (4), the organisation shall provide the individual with access to the personal data and other information without the personal data or other information excluded under subsections (2), (3) and (4).

Where, by reason of subsection (2) or (3), an organisation refuses to or otherwise does not provide an individual with the individual's personal data or other information requested under subsection ( 1), the organisation shall -

(aJ notify the individual of the refusal within the prescribed time and in accordance with the prescribed requirements; and

(bJ preserve, for not less than the prescribed period, a copy of the personal data concerned, if available.

Where an organisation provides an individual, in accordance with subsection (5), with the individual's personal data or other information requested under subsection ( 1), the organisation shall notify the individual of the exclusion of any personal data or other information so requested under subsection (2) or (3).

The organisation shall ensure that the copy of the personal data it preserves for the purposes of subsection (6)(bJ is a complete and accurate copy of the personal data concerned.

An individual may request an organisation to correct an error or omission in the personal data about the individual that is in the possession or under the control of the organisation.

Unless the organisation is satisfied on reasonable grounds that a correction should not be made, the organisation shall -

(a} correct the personal data as soon as practicable; and

{b) subject to subsection (3), send the corrected personal data to every other organisation to which the personal data was disclosed by the organisation within a year before the date the correction was made, unless that other organisation does not need the corrected personal data for any legal or business purpose.

An organisation (not being a credit bureau) may, if the individual consents, send the corrected personal data only to specific organisations to which the personal data was disclosed by the organisation within a year before the date the correction was made.

When an organisation is notified under subsection (2)(b} or (3) of a correction of personal data, the organisation shall correct the personal data in its possession or under its control unless the organisation is satisfied on reasonable grounds that the correction should not be made.

If no correction is made under subsection (2){a} or (4), the organisation shall annotate the personal data in its possession or under its control with the correction that was requested but not made.

Nothing in this section shall require an organisation to correct or otherwise alter an opinion, including a professional or an expert opinion.

An organisation is not required to comply with this section in respect of the matters specified in Schedule 4.

The Authority may, on the application of any organisation, by notice in writing exempt the organisation from any prescribed requirement pursuant to subsection ( 1) in respect of any transfer of personal data by that organisation.

An exemption under subsection (2) -

(a} may be granted subject to such conditions as the Authority may specify in writing; and

(b} need not be published in the Gazette and may be revoked at any time by the Authority.

The Authority may at any time add to, vary or revoke any condition imposed under this section.

PART7

NOTIFICATION OF DATA BREACHES

Without limiting subsection (1){a}, a data breach is deemed to result in significant harm to an individual -

fa} if the data breach is in relation to any prescribed personal data or class of personal data relating to the individual; or

{b) in other prescribed circumstances.

Without limiting subsection (1){b}, a data breach is deemed to be of a significant scale -

fa} if the data breach affects not fewer than the prescribed number of affected individuals; or

Notwithstanding subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.

Subject to subsection (2), where an organisation has reason to believe that a data breach affecting personal data in its possession or under its control has occurred, the organisation shall conduct, in a reasonable and expeditious manner, an assessment of whether the data breach is a notifiable data breach.

Where a data processor (other than a data processor mentioned in section 29) has reason to believe that a data breach has occurred in relation to personal data that the data processor is processing on behalf of and for the purposes of another organisation -

30

(a} the data processor shall, without undue delay, notify the other organisation of the occurrence of the data breach; and

(b} the other organisation shall, on notification by the data processor, conduct an assessment of whether the data breach is a notifiable data breach.

The organisation shall carry out the assessment mentioned m subsection (1) or 2{b} in accordance with any prescribed requirements.

Where an organisation assesses, in accordance with section 27, that a data breach is a notifiable data breach, the organisation shall notify the Authority as soon as is practicable, but in any case no later than 3 days after the day the organisation makes that assessment.

Subject to subsections (5), (6) and (7), on or after notifying the

Authority under subsection ( 1), the organisation shall also notify each affected individual affected by a notifiable data breach mentioned in section 26(1){a} in any manner that is reasonable in the circumstances.

The notification under subsection (1) or (2) shall contain, to the best of the knowledge and belief of the organisation at the time it notifies the Authority or affected individual, all the information that is prescribed for this purpose.

The notification under subsection (1) shall be made in such form and manner as the Authority may require.

Subsection (2) does not apply to an organisation m relation to an affected individual if the organisation -

(a} on or after assessing that the data breach is a notifiable data breach, takes any action, in accordance with any prescribed requirements, that renders it unlikely that the notifiable data breach will result in significant harm to the affected individual; or

(b} had implemented, prior to the occurrence of the notifiable data breach, any technological measure that renders it unlikely that the notifiable data breach will result in significant harm to the affected individual.

No organisation shall notify any affected individual in accordance with subsection (2) if -

(a} a prescribed law enforcement agency so instructs; or 31

{b) the Authority so directs.

The Authority may, on the written application of an organisation, waive the requirement to notify an affected individual under subsection (2)

subject to any condition that the Authority thinks fit.

An organisation is not, by reason only of notifying the Authority under subsection ( 1) or an affected individual under subsection (2), to be regarded as being in breach of -

{a) any duty or obligation under any written law or rule of law, or any contract, as to secrecy or other restriction on the disclosure of information; or

{b) any rule of professional conduct applicable to the organisation.

Subsections ( 1) and (2) apply concurrently with any obligation of the organisation under any other written law to notify any other person (including any public agency) of the occurrence of a data breach, or to provide any information relating to a data breach.

a loss of an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of remuneration, but does not include, in relation to an individual, the loss of personal data about the individual.

If-

33

fa} an individual discloses, or the individual's conduct causes disclosure of, personal data in the possession or under the control of an organisation or a public agency to another person;

In proceedings for an offence under subsection ( 1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following-

{a} that-

For the avoidance of doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the disclosure of personal data in the possession or under the control of an organisation or a public agency by or under any written law.

In this section, "applicable contravention" means a contravention of any of the following -

fa} subsection (1);

{b) section 33( 1).

If-

(a} an individual makes use of personal data in the possession or under the control of an organisation or a public agency;

In proceedings for an offence under subsection (1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following-

35

(a} that-

For the avoidance of doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the use of personal data in the possession or under the control of an organisation or a public agency by or under any other written law.

In this section, "applicable contravention" means a contravention of section 31(1) or 33(1).

If-fa} an individual takes any action to re-identify or cause re-identification of the individual to whom anonymised information in the possession of or under the control of an organisation or a public agency relates (referred to in this section as the affected individual);

{b) the re-identification is not authorised by the organisation or public agency; and

{c) the individual does so-

In proceedings for an offence under subsection ( 1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following-

36

(a} that-

For the avoidance of doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the re-identification of the affected individual by or under any other written law.

In this section -

"applicable contravention" means a contravention of subsection (1);

"specified purpose" means any purpose specified in Schedule 5.

37

PART9

ENFORCEMENT

Subject to subsection (1), the Authority may, with or without the consent of the complainant and the organisation, direct the complainant or the organisation or both to attempt to resolve the complaint of the complainant in the way directed by the Authority.

For the purposes of subsection (1), the Authority may establish or approve one or more dispute resolution schemes for the resolution of complaints by individuals against organisations.

On the application of a complainant, the Authority may review-

{a) a refusal by an organisation to provide access to personal data or other information requested by the complainant under section 18, or the organisation's failure to provide that access within a reasonable time;

On completion of its review under subsection (1), the Authority may-

The Authority may, if it is satisfied that an organisation has not complied or is not complying with any provision of Part 3, 4, 5, 6 or 7, give the organisation any direction that the Authority thinks fit in the circumstances to ensure compliance with that provision.

Without limiting subsection (1), the Authority may, if it thinks fit in the circumstances to ensure compliance with any provision of Part 3, 4, 5, 6 or 7, give an organisation all or any of the following directions -

{a} to stop collecting, using or disclosing personal data m contravention of this Order;

{b) to destroy personal data collected in contravention of this Order;

{c) to comply with any direction of the Authority under section 35(2).

Subject to subsection (2), the Authority may, if it is satisfied that an organisation has intentionally or negligently contravened any provision of

where the Authority intends to give any direction under section 36, specifying the direction the Authority proposes to give;

specifying each instance of non-compliance that is the subject of the proposed action, or the reason or reasons for the proposed action; and

subject to subsections (2) and (3), specifying the time within which written representations may be made to the Authority with respect to the proposed action.

Where the Authority intends to impose a financial penalty under section 37( 1) on an organisation, the time specified in the notice within which written representations may be made to the Authority shall be at least 14 days after the date the notice is served on that organisation.

The Authority may, on written application by the organisation concerned (whether before, on or after the expiry of the time specified in the notice), extend the time for the organisation to make written representations to the Authority if the Authority is satisfied that the extension should be granted by reason of exceptional circumstances in the particular case.

The Authority may decide to give the direction under section 36 or impose the financial penalty under section 37(1) -

(a} after considering any written representation made to the Authority pursuant to the notice mentioned in subsection (1); or

Subsection (1) does not apply where the organisation has died, is adjudged bankrupt, has been dissolved or wound up or has otherwise ceased to exist.

Where the Authority decides to give the direction under section 36 or impose the financial penalty under section 37(1), the Authority shall serve a notice of the decision on the following persons -

(a} the organisation concerned;

41

{b) the complainant whose complaint against the organisation concerned resulted in the giving of the direction or the imposition of the financial penalty, if any.

A direction given under section 36 or the imposition of a financial penalty under section 37( 1) takes effect only when the Authority serves the notice in subsection (6){a} on the organisation concerned.

Where the Authority imposes a financial penalty under section 37(1)

on an organisation, the notice in writing issued by the Authority to the organisation shall specify the date before which the financial penalty is to be paid, being a date not earlier than 28 days after the notice is issued.

The Authority may, on written application by an organisation on whom a financial penalty under section 37(1) is imposed-fa} extend the time for the organisation to pay the financial penalty; or

{b) allow the financial penalty to be paid by instalments.

( 10) The interest payable -

fa} on the outstanding amount of any financial penalty imposed under section 37(1); and

{b) for payment by instalments, as the Authority may allow, of any financial penalty imposed under section 37(1), shall be at such rate as the Authority may direct, which shall not exceed the rate prescribed in the Rules of Court made under the Supreme Court Act (Chapter 5)

in respect of judgment debts.

Without affecting sections 36, 37(1) and 43(1), where the Authority has reasonable grounds to believe that an organisation has not complied, is not complying or is likely not to comply with any provision of Part 3, 4, 5, 6 or 7, the organisation concerned may give, and the Authority may accept, a written voluntary undertaking.

Without limiting the matters to which the voluntary undertaking may relate, the voluntary undertaking may include any of the following undertakings by the organisation concerned -

fa} an undertaking to take specified action within a specified time;

Subject to subsection (4), the Authority may, after accepting the voluntary undertaking and with the agreement of the organisation who gave the voluntary undertaking -

(a} vary the terms of any undertaking included m the voluntary undertaking; or

Where an organisation fails to comply with any undertaking in a voluntary undertaking -

(a} the Authority may give the organisation concerned any direction that the Authority thinks fit in the circumstances to ensure the compliance of the organisation with that undertaking; and

In addition, where an organisation fails to comply with an undertaking mentioned in subsection (2){c}, the Authority may publicise the voluntary undertaking in accordance with the undertaking, and recover the costs and expenses so incurred from the organisation as a debt due to the Authority.

An organisation or an individual aggrieved by-

{a} any direction made by the Authority under section 34(2), 36(1)

or (2) or 39(4); or

An organisation aggrieved by a financial penalty imposed by the

Authority under section 37(1) on the organisation may make a written application to the Authority to reconsider the decision to impose the financial penalty or the amount of the financial penalty so imposed in accordance with this section.

Unless the Authority decides otherwise in any particular case, an application for reconsideration does not suspend the effect of the direction or decision to be reconsidered except in the case of an application for reconsideration under subsection (2).

The application for reconsideration shall -

{a} subject to subsection (5), be submitted to the Authority within the prescribed period;

The Authority may, on written application by the organisation or an individual concerned, whether before, on or after the expiry of the prescribed period mentioned in subsection (4){a}, extend the time for the organisation or the individual to make the application for reconsideration if the Authority is satisfied that the extension should be granted by reason of exceptional circumstances in the particular case.

If an application for reconsideration is made in accordance with this section, the Authority shall -

{a} reconsider the direction or decision;

There is to be no application for reconsideration of a decision made under subsection (6)(b}.

not more than thirty members, appointed by the Minister on the basis of their ability and experience in industry, commerce or administration or their professional qualifications or their suitability otherwise for appointment.

For the purpose of hearing any appeal under section 42, the Chairman of the Appeal Panel may nominate three or more members of the Appeal Panel, which may include the Chairman of the Appeal Panel, to constitute a Data

Protection Appeal Committee.

Schedule 6 has effect with respect to the Appeal Panel, Appeal

Committee and their members and the proceedings.

An organisation or a person (including an individual who IS a complainant) aggrieved by -

(a} any direction made by the Authority under section 34(2), 36(1)

or (2) or 39(4);

An organisation aggrieved by a financial penalty imposed by the

Authority under section 37(1) on the organisation may, within the prescribed period, appeal to the Chairman of the Appeal Panel against the decision to impose the financial penalty or the amount of the financial penalty so imposed.

Where an application for reconsideration has been made under section 40, every appeal in respect of the same direction or decision which is the subject of the application for reconsideration is deemed to be withdrawn.

Unless the Appeal Committee decides otherwise in any particular case, the making of an appeal under this section does not suspend the effect of the direction or decision to which the appeal relates except in the case of an appeal under subsection (2).

An Appeal Committee hearing an appeal may confirm, vary or set aside the direction or decision which is the subject of the appeal and, in particular, may -

(a} remit the matter to the Authority;

A direction or decision of an Appeal Committee on an appeal has the same effect, and may be enforced in the same manner, as a direction or decision of the Authority, except that there is to be no application for further reconsideration under section 40 and no further appeal under this section from the direction or decision of the Appeal Committee.

If an Appeal Committee confirms the direction or decision which is the subject of the appeal, it may nevertheless set aside any finding of fact on which the direction or decision was based.

The decision of an Appeal Committee is final.

The Authority may, on complaint or of its own motion, conduct an investigation under this section to determine whether or not an organisation is complying with this Order, including a voluntary undertaking given under section 39.

The Authority may suspend, discontinue or refuse to conduct an investigation under this section if it thinks fit, including but not limited to any of the following circumstances -

(a} the complainant has not complied with a direction under section 34(2);

For the avoidance of doubt, notwithstanding subsection (Z)(d}, the

Authority may conduct or resume an investigation under this section at any time if an organisation fails to comply with a voluntary undertaking given under section 39(1) in relation to any matter.

An organisation shall retain records relating to an investigation under this section for one year after the conclusion of the investigation or any longer period specified in writing by the Authority.

For the purposes of an investigation under section 43, the Authority or any authorised officer may, by notice in writing to any organisation, require the organisation to produce to the Authority or the authorised officer a specified document or specified information, which the Authority or authorised officer considers relates to any matter relevant to such investigation.

A notice under subsection (1) shall indicate the purpose for which the specified document or specified information is required by the Authority.

The Authority may specify in the notice -

(aJ the time and place at which any document is to be produced or any information is to be provided; and

(bJ the manner and form in which it is to be produced or provided.

The power under this section to require an organisation to produce a document includes the power -

(a} if the document is produced-

In subsections (1) and (2), "specified" means-

(aJ specified or described in the notice; or

(bJ falling within a category which is specified or described in the notice.

For the purposes of an investigation under section 43, the Authority or any authorised officer may do all or any of the following -

(aJ require, by notice in writing, any person whom the Authority or authorised officer reasonably believes has any information, or any document in custody or control of the person, that is relevant to the investigation, to furnish that information or document, within the time and manner specified in the notice in writing;

(bJ require, by notice in writing, any person within the limits of

Brunei Darussalam, who appears to be acquainted with the facts or 48

circumstances of the matter, to attend before the Authority or authorised officer;

(c} examine orally any person who appears to be acquainted with the facts or circumstances of the matter.

A person examined under subsection (l)(c} is bound to state truly the facts and circumstances with which the person is acquainted concerning the matter except that the person need not say anything that might expose the person to a criminal charge, penalty or forfeiture.

be-

A statement made by a person examined under subsection (l)(c} shall

(a} reduced to writing;

(b} read over to the person;

(c} if the person does not understand English, interpreted m a language that the person understands; and

(d} after correction (if necessary), signed by the person.

In connection with an investigation under section 43, an authorised officer, and such other persons as the authorised officer may require to assist him, may enter any premises.

No authorised officer or person assisting the authorised officer shall enter any premises in exercise of the powers under this section unless the authorised officer has given the occupier of the premises a notice in writing which-

(a} gives at least 2 working days' notice of the intended entry; and

(b} indicates the subject matter and purpose of the investigation.

Subsection (2) does not apply if the authorised officer has reasonable grounds for suspecting that the premises are, or have been, occupied by an organisation which is being investigated in relation to a contravention of this

Order and if the authorised officer has taken all such steps as are reasonably practicable to give notice in writing under that subsection but has not been able to do so.

Where subsection (3) applies, the power of entry conferred by subsection ( 1) shall be exercised on production of -

{a} evidence of the authorised officer's appointment; and

{bj a document containing the information referred to m subsection (2){bj.

An authorised officer or a person assisting the authorised officer entering any premises under this section may -

fa} take with him such equipment as appears to him to be necessary;

(bj require any person on the premises-

A warrant under this section shall authorise a named officer, and such other persons as the authorised officer may require to assist him, to do all or any of the following -

51

fa} to enter the premises specified in the warrant, using such force as is reasonably necessary for the purpose;

(b} to search any person on those premises if there are reasonable grounds for believing that the person has in his possession any document, equipment or article which has a bearing on the investigation;

(c}

to search the premises and take copies of, or extracts from, any document appearing to be of a kind in respect of which the application under subsection (1) was granted (the relevant kind);

If, in the case of a warrant under subsection (l)(b), the court is satisfied that it is reasonable to suspect that there are also on the premises other documents relating to the investigation concerned, the warrant shall also authorise the actions mentioned in subsection (2) to be taken in relation to any such document.

Where possession of any document is taken under subsection (2)(d)

or (3), the named officer may, at the request of the person from whom possession of the document was taken, provide such person with a copy of the document.

A named officer may allow any equipment or article which has a bearing on an investigation and which may be removed from any premises for examination under subsection (2)(h) to be retained on those premises subject to such conditions as the named officer may require.

A warrant issued under this section shall-

The powers conferred by this section shall not be exercised except on production of a warrant issued under this section.

Any person entering any premises by virtue of a warrant under this section may take with him such equipment as appears to him to be necessary.

If there is no one at the premises when the named officer proposes to execute such a warrant, he shall, before executing it -

{a} take such steps as are reasonable in all the circumstances to inform the occupier of the intended entry; and

(b} if the occupier is informed, afford him or his legal or other representative a reasonable opportunity to be present when the warrant is executed.

If the named officer is unable to inform the occupier of the intended entry, he shall, when executing the warrant, leave a copy of the warrant in a prominent place on the premises.

On leaving any premises which he has entered by virtue of a warrant under this section, the named officer shall, if the premises are unoccupied or the occupier IS temporarily absent, leave them as effectively secured as he found them.

Any document of which possession is taken under subsection (2){d}

or (3) may be retained for a period of not more than 3 months.

In this section-

"named officer" means an authorised officer named in the warrant;

"occupier", in relation to any premises, means a person whom the authorised officer reasonably believes is the occupier of those premises.

Any person who-

{a} makes a request under section 18(1) to obtain access to personal data about another individual; or

(b} makes a request under section 19(1) to change personal data about another individual, without the authority of the individual, is guilty of an offence and liable on conviction to a fine not exceeding $5,000, imprisonment for a term not exceeding 12 months or both.

An organisation or person who-

(a} with an intent to evade a request under section 18 or 19, disposes of, alters, falsifies, conceals or destroys, or directs another person to dispose of, alter, falsify, conceal or destroy, a record containing -

Where an offence under this Order committed by a body corporate is proved-fa} to have been committed with the consent or connivance of an officer; or fb} to be attributable to any neglect on his part, the officer as well as the body corporate is guilty of that offence and liable to be proceeded against and punished accordingly.

Where the affairs of the body corporate are managed by its members, subsection ( 1) applies in relation to the acts and defaults of a member in connection with his functions of management as if he were a director of that body corporate.

Where an offence under this Order committed by a partnership IS proved-fa} to have been committed with the consent or connivance of a partner; or fb} to be attributable to any neglect on his part, the partner as well as the partnership is guilty of that offence and liable to be proceeded against and punished accordingly.

Where an offence under this Order committed by a limited liability partnership is proved -

fa} to have been committed with the consent or connivance of a partner or manager of the limited liability partnership; or fb} to be attributable to any neglect on their part, the partner or manager, as well as the partnership is guilty of that offence and liable to be proceeded against and punished accordingly.

Where an offence under this Order committed by an unincorporated association (other than a partnership) is proved-

(a} to have been committed with the consent or connivance of; or 55

(b} to be attributable to any neglect on the part of, an officer of the unincorporated association or a member of its governing body, the officer or member, as well as the unincorporated association is guilty of that offence and liable to be proceeded against and punished accordingly.

A person mentioned in subsections (1), (2), (3), (4) and (5) may rely on a defence that would be available to the body corporate, partnership, limited liability partnership or unincorporated association if it were charged with the offence with which the person is charged and, in doing so, the person bears the same burden of proof that the body corporate, partnership, limited liability partnership or unincorporated association would bear.

In this section, unless the context otherwise requires -

"officer"-

(a} in relation to a body corporate, means a director, member of the committee of management, chief executive, manager, secretary or other similar officer of the body corporate, any person who holds a controlling interest in that body, and includes a person purporting to act in any such capacity; or

(b} in relation to an unincorporated association (other than a partnership), means the president, the secretary or a member of the committee of the unincorporated association or a person holding a position analogous to that of president, secretary or member of a committee, and includes a person purporting to act in any such capacity;

"partner", in relation to a partnership, includes a person purporting to act as a partner.

Liability of employers for acts of employees 51.

( 1) Any act done or conduct engaged in by a person in the course of his employment (referred to in this section as the employee) is treated for the purposes of this Order as done or engaged in by his employer as well as by him, whether or not it was done or engaged in with the employer's knowledge or approval.

In any proceedings for an offence under this Order brought against any person in respect of an act or conduct alleged to have been done or engaged in by an employee of that person, it is a defence for that person to prove that he took such steps as were practicable to prevent the employee from doing the act or 56

engaging in the conduct, or from doing or engaging in, in the course of his employment, acts or conduct, of that description.

Composition of offences 52.

The Authority or any person authorised in writing in that behalf by the

Authority may compound any offence against this Order which is prescribed as a compoundable offence by collecting from the person reasonably suspected of having committed the offence a sum not exceeding -

{a} one half of the amount of the maximum fine prescribed for the offence; or

{b} $5,000, whichever is the lower.

On payment of the sum of money, no further proceedings shall be taken against the person in respect of the offence.

All sums collected under this section shall be paid to the Authority.