The Personal Information Protection Act 2016, the island's
data protection legislation, applies to all organisations that use
personal information in Bermuda.
These three terms — organisations, use and personal
information — are defined in the Act.
In the context of trust structures, "organisations"
may include individual trustees, private trust companies, regulated
local trust companies, underlying holding companies and
protectors.
Navigating how each organisation must comply with Pipa in
connection with any trust can be daunting.
For example, are individual trustees of the same trust, or a
trustee and a protector of the same trust, more than one
"organisation" for the purposes of Pipa, given that
trusts do not have legal personality and "organisation"
is not defined to include either a trust or a collection of
individuals (or individuals and entities) with a common
purpose?
