The Authority for Info-communications Technology Industry of Brunei (AITI) requires type approval of telecommunication, radiocommunication and satellite equipment to be sold and used in Brunei. Overseas manufacturers are not allowed to possess a type-approval certificate. They can do so only through a local dealer/representative. Applicants seeking Dealer Type Approval must hold a valid Dealer Licence issued by AITI. All Type Approval certificates are renewable every five years. Still, it is necessary to inform AITI of any changes to the product, regardless of how minor they may be, and whether they might not affect the previous declaration/certificate (Section 9).

Pursuant to Art. 7(c) of the Personal Data Protection Order, 2025, organisations must designate one or more individuals to take responsibility for ensuring compliance with the Order. Although the Order was published in January 2025, it provides for phased commencement through Gazette notifications. Accordingly, Part 3, including Art. 7, entered into force on 1 January 2026, rather than on the publication date.

Section 14.1.c of the Personal Data Protection Order provides that an organisation may disclose an individual’s personal data without their consent in the circumstances, for the purposes, and subject to the conditions specified in Part 3 of Schedule 2. Part 3 of Schedule 2 permits, inter alia, the disclosure of personal data to a public agency where such disclosure is necessary in the public interest or for the purposes of policy formulation or review. It also authorises the disclosure of personal data to an officer of a prescribed law enforcement agency, provided that the officer produces written authorisation signed by the head or director of that agency, or by another person of equivalent seniority, certifying that the data is required for the performance of the officer’s functions or duties. No requirement for obtaining a court order in relation to these powers has been identified.
Under Notification of Commencement No. S 11, Section 14 and Schedule 2 are scheduled to enter into force on 1 January 2026.

Section 62 of the Telecommunications Order provides that the Authority for Info‑communications Technology Industry of Brunei Darussalam, or any officer duly authorised by the Authority, may, for the purpose of performing its functions under the Order, require any person to supply information in their possession relating to any telecommunication service or system, and may further require any person who has custody or control of any document concerning such a service or system either to transmit the document to the Authority for inspection or to provide a copy or extract of it. No requirement for obtaining a court order in relation to these powers has been identified.

A basic legal framework on intermediary liability for copyright infringement is absent in Brunei's law and jurisprudence. Although Section 10 of the Electronic Transactions Act protects the network service providers from liability concerning third-party material in the form of electronic records in certain circumstances, this exemption does not affect the obligation of such network service provider founded on a contract, under any licensing/regulatory regime, or any written law or court order. Furthermore, Brunei is a member of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), and it will be required to implement the relevant provisions on intermediary liability.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Brunei's law and jurisprudence. Despite Section 10 of the Electronic Transactions Act protects the network service providers from liability with respect to third-party material in the form of electronic records in certain circumstances, this exemption does not affect the obligation of such network service provider founded on a contract, under any licensing/regulatory regime, or under any written law or court order. Furthermore, Brunei is a member of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), and it will be required to implement the relevant provisions on intermediary liability.

Pursuant to Section 3.4 of the Licensing and Regulatory Framework, foreign persons are prohibited from holding a majority shareholding or exercising control, whether directly or indirectly, in a company applying for a licence to provide telecommunications services. This restriction applies to both Infrastructure Provider for the Telecommunications Industry (INTI) licences and Service Provider for the Telecommunications Industry (SETI) licences.

It is reported that the telecommunications industry is dominated by government-linked companies. Among these are Datastream Digital, Imagine, and Progresif. In 2019, the government consolidated the infrastructure of all three companies under a state-owned wholesale network operator called Unified National Networks (UNN). The UNN is a wholly government-owned enterprise.

It is reported that Brunei does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market. However, according to the Market Review Guidelines, accounting separation is among the remedies that the Authority for Info-communications Technology Industry (AiTi) may impose for companies with SMP.

Brunei has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Authority for Info-communications Technology Industry (AiTi), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

The Data Protection Policy (DPP) applies only to public agencies, including government Ministries and Departments, educational institutions and statutory bodies. Section 18 provides that the agencies can transfer personal data to a party outside of Brunei only if:
- There is a reasonable belief that the recipient is subject to a law, binding scheme or contract which upholds principles for fair data handling substantially similar to the DPP;
- The individual has provided consent;
- It is necessary for contract performance or pre-contractual obligations; and
- Reasonable steps have been taken to ensure the data will not be used, held or disclosed by the recipient in a manner inconsistent with the DPP.

Section 24 of the Personal Data Protection Order provides that an organisation may not transfer personal data to any country outside Brunei unless the transfer is carried out in accordance with prescribed requirements intended to ensure that the data receives a standard of protection comparable to that afforded under the Order. The Authority may, upon application by an organisation, issue a written notice granting an exemption from any such requirement, and may impose conditions on the exemption as it considers appropriate. Any exemption or condition may be added to, varied, or revoked by the Authority at any time.
Under Notification of Commencement No. S 11, Section 24 is scheduled to enter into force on 1 January 2026.

Brunei has joined an agreement with binding commitments to open data transfers across borders: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11).

The Personal Data Protection Order establishes a comprehensive framework for the protection of personal data in Brunei. The Order designates the Authority for Info‑Communications Technology Industry of Brunei Darussalam (AITI) as the supervisory body responsible for the enforcement and administration of all data protection laws and regulations. Notifications of Commencement No. S 10 and No. S 11 specify the dates on which the different parts of the Order are scheduled to take effect, with the legislation set to come fully into force on 1 January 2026.