Privacy Map

Latin America & Caribbean. National jurisdiction.

Bermuda BM

Primary authority: Office of the Privacy Commissioner for Bermuda (PrivCom)
Part I

Domestic law

Comprehensive data protection1

  • PIPAPersonal Information Protection Act 2016 (PIPA)In force
    In force from     Bermuda's comprehensive privacy law built on fairness, proportionality and accountability, requiring a privacy officer, breach notification and comparable-protection safeguards for overseas transfers.
    Synopsis

    Bermuda's comprehensive privacy law built on fairness, proportionality and accountability, requiring a privacy officer, breach notification and comparable-protection safeguards for overseas transfers.

    Key themes
    • privacy officer
    • fairness
    • breach notification
    • overseas transfers
    • Commissioner
    Unique features

    Commissioner can designate comparable jurisdictions; directors and officers personally exposed.

    SaaS relevance

    Organisations using SaaS in Bermuda must ensure overseas providers give comparable protection.

    Extraterritorial
    No
    Breach notification
    Commissioner and individuals without undue delay where likely adverse effect
    DPO
    Yes
    Cross-border transfers
    Comparable protection: designation, contracts, codes
    Maximum penalty
    BMD 250,000 (organisations); BMD 25,000 and/or 2 years (individuals)
    Key dates
    • Adopted
    • In force
    • Partially enacted 2016; Privacy Commissioner appointed 2020-01-20; principal provisions in force 2025-01-01
    Text
    Authority
    Office of the Privacy Commissioner for Bermuda (PrivCom)
    Sources consulted
    Verification

    High confidence.

    Bermuda is a North Atlantic territory grouped here per brief.

    Full record for PIPA