Brunei Personal Data Protection Order 2025

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	BN PDPO
Region	Asia-Pacific
Country or scope	Brunei
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers BN PDPO

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`BN-PDPO-PROT` Protection Obligation	Organisations must make reasonable security arrangements to protect personal data against unauthorised access, modification or disposal, evidenced by integrity hashes across processing-system components (PDPO 2025, protection obligation)	Scan
`BN-PDPO-ACC` Accountability Obligation	Organisations must develop policies and practices to meet their PDPO obligations, which requires an accurate inventory of the software that processes personal data (PDPO 2025, accountability obligation and DPO designation)	Scan
`BN-PDPO-INT` Data Intermediary Oversight	Data intermediaries processing on behalf of an organisation must be engaged under contract and remain the organisation's responsibility, so third-party components must have identifiable suppliers (PDPO 2025, data intermediary provisions)	Scan
`BN-PDPO-BRN` Data Breach Notification Readiness	Notifiable data breaches must be reported to the authority, which requires affected components to be quickly identifiable via PURL or CPE identifiers (PDPO 2025, data breach notification obligation)	Scan
`BN-PDPO-DOC` Demonstrable Policies and Records	Organisations must be able to demonstrate their data-protection practices on request, so software records must be machine-readable, dated and identifiable documents (PDPO 2025, openness and accountability duties)	Scan

All 22 from the standard set, adapted to BN PDPO.