Bermuda. Comprehensive data protection. Act
PIPAPersonal Information Protection Act 2016 (PIPA)
In force
§1Summary
- Synopsis
Bermuda's comprehensive privacy law built on fairness, proportionality and accountability, requiring a privacy officer, breach notification and comparable-protection safeguards for overseas transfers.
- Key themes
- Unique features
Commissioner can designate comparable jurisdictions; directors and officers personally exposed.
- SaaS relevance
Organisations using SaaS in Bermuda must ensure overseas providers give comparable protection.
§2Obligations
- Extraterritorial
- No
- Breach notification
- Commissioner and individuals without undue delay where likely adverse effect
- DPO
- Yes
- Cross-border transfers
- Comparable protection: designation, contracts, codes
- Maximum penalty
- BMD 250,000 (organisations); BMD 25,000 and/or 2 years (individuals)
§3Dates
- Key dates
- Adopted
- In force
- Partially enacted 2016; Privacy Commissioner appointed 2020-01-20; principal provisions in force 2025-01-01
§4Text and authority
- Text
- Authoritative text bermudalaws.bm
- Authority
- Office of the Privacy Commissioner for Bermuda (PrivCom)
§5Where it applies
- Domestic law of
- Bermuda
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Bermuda is a North Atlantic territory grouped here per brief.