Section 31
Unauthorised disclosure of personal data
of Personal Data Protection Order, 2025
(1)
If-
33
fa} an individual discloses, or the individual's conduct causes disclosure of, personal data in the possession or under the control of an organisation or a public agency to another person;
(b)
the disclosure is not authorised by the organisation or public agency; and
{c) the individual does so -
(i)
knowing that the disclosure is not authorised by the organisation or public agency; or
(ii)
reckless as to whether the disclosure is or is not authorised by the organisation or public agency,
BRUNEI DARUSSALAM GOVERNMENT GAZETTE the individual is guilty of an offence and liable on conviction to a fine not exceeding $5,000, imprisonment for a term not exceeding 2 years or both.
(2)
In proceedings for an offence under subsection ( 1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following-
{a} that-
(i)
the personal data in the possession or under the control of an organisation or a public agency, that was disclosed was, at the time of the disclosure, publicly available; and
(ii)
where the personal data was publicly available solely because of an applicable contravention, the accused did not know, and was not reckless as to whether, that was the case;
{b) that the accused disclosed, or caused the disclosure of, personal data in the possession or under the control of the organisation or public agency-
(i)
as permitted or required by or under any written law (other than this Order);
(ii)
as authorised or required by an order of court;
(iii)
in the reasonable belief that, and was not reckless as to whether, the accused had the legal right to do so; or
(iv)
in any other circumstances, or for any other purpose, prescribed.
(3)
For the avoidance of doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the disclosure of personal data in the possession or under the control of an organisation or a public agency by or under any written law.
(4)
In this section, "applicable contravention" means a contravention of any of the following -
fa} subsection (1);
{b) section 33( 1).