According to the Guidelines on Information Technology Risk Management, the communications and transfer of sensitive and customer confidential information should only be through encrypted channels or the data to be sent should have strong encryption. The encryption key of the data should be sent via a separate transmission channel to the intended recipients. However, these guidelines are not legally binding.2020 Investment Climate Statements on Brunei by US Department of State affirms that Brunei has not announced any specific legislation pertaining to data storage and data localisation requirements.