On 1st January 2025, Bermuda's Personal Information
Protection Act 2016 (PIPA) came into full force and effect. Based
on the core principles of data protection and privacy law
internationally, PIPA has profound operational, legal compliance
and corporate governance implications for all businesses that use
personal information in Bermuda. At the same time, PIPA brings
Bermuda into the accepted world of international 'safe data
harbours'.
Like most regulatory authorities in Bermuda, the Privacy
Commissioner under PIPA has the authority to: conduct
investigations concerning PIPA compliance, make PIPA compliance
orders upon the completion of an investigation, educate the public
about this Act, receive comments from the public concerning the
administration of this Act and, to do anything which reasonably
appears to the Privacy Commissioner to be conducive to the carrying
out of his functions under this Act. Also, the authority of the
Privacy Commissioner is supported by