Brunei

Sections 8 and 10 require consent (or deemed consent) before personal data is collected, used or disclosed, with purposes notified under section 17. Section 18 gives a right of access and section 19 a right of correction. Section 13 allows withdrawal of consent on reasonable notice.

Section 28(1) requires an organisation to notify the Authority as soon as practicable and no later than 3 days after assessing a breach as notifiable. Section 28(2) requires notification of affected individuals where significant harm is likely. Section 27(1) requires the assessment to be carried out in a reasonable and expeditious manner.

Section 14(4) requires records to be kept for at least 7 years from the date the relevant transaction was completed.

Section 22(1) of the Criminal Asset Recovery Order, 2012 requires institutions to develop and implement programmes for preventing money laundering and terrorist financing. Section 22(2) requires a compliance officer at management level responsible for ongoing compliance.

Paragraph 4.1 requires notification to BDCB's Technology Risk team within 1 hour of discovering a suspected incident. Paragraph 4.2 requires an assessment and notification within 2 hours, and paragraph 4.4 requires updates at least twice every calendar day once an incident is confirmed.

Paragraph 4.2 requires notification to BDCB no later than 1 working day after detection, the reporting form within 5 working days and a resolution summary within 10 working days of resolution. Paragraph 4.1A requires reporting of certain fraud types regardless of materiality.

Section 15(1) requires institutions to submit a report to the FIU promptly after forming a suspicion. BDCB accepts reports through its Integrated Financial Intelligence System (IFIS).