Section 10 — Personal Data Protection Order, 2025

(1)

An individual has not given consent under this Order for the collection, use or disclosure of personal data about the individual by an organisation for a purpose unless -

(a} the individual has been provided with the information required under section 17; and

(b} the individual provided his consent for that purpose in accordance with this Order.

(2)

An individual has not given clear and unambiguous consent under this

Order for the use of his Brunei Darussalam telephone number for the purpose of receiving a direct marketing message unless -

(a} the individual has been provided with the information required under section 17;

(b} the individual provided his consent for that purpose in accordance with this Order; and

(c)

the consent of the individual is given in written or other form so as to be accessible for subsequent reference.

(3)

No organisation shall -

(a)

as a condition of providing a product or service, require an individual to consent to the collection, use or disclosure of personal data about the individual beyond what is reasonable to provide the product or service to that individual; or

(b)

obtain or attempt to obtain consent for collecting, using or disclosing personal data by providing false or misleading information with respect to the collection, use or disclosure of the personal data, or using deceptive or misleading practices.

(4)

Any consent given in any of the circumstances in subsection (3) is not validly given for the purposes of this Order.