Directors Liable For PIPA Compliance Failure In Bermuda

There are several aspects of an enterprise's use of data that now must land on the boardroom table of Bermuda organisations, including cybersecurity oversight. Compliance with the island's Personal Information Protection Act 2016 must be added to that list when it comes into full force on 1 January, 2025.

For example, the various iterations of the Bermuda Monetary Authority's published Codes of Conduct concerning the operational management of cyber-risk expressly establish the clear and fundamental principle that the board of directors must have governance oversight of cyber-risk.

Perhaps the Government's "codes of practice" to be issued under Bermuda's recent Cybersecurity Act 2024 may follow the BMA's model of ultimate board responsibility.