It’s Time To Bridge Pipa Compliance Gap

A review of 200 publicly available privacy notices of companies in Bermuda has revealed that just one in nine are fully compliant with the Personal Information Protection Act 2016.

Under Pipa — which became fully effective on January 1, 2025 — privacy notices are the primary mechanism for an organisation to meet its transparency obligations. When a notice is noncompliant, it creates specific legal vulnerabilities and financial implications.

My review also found varying levels of compliance with the legislation.

Forty-four per cent of companies reviewed had no privacy notice, 6 per cent were inherited from notices with a General Data Protection Regulation (European Union) framework, 3 per cent had global policies and 37 per cent were deficient primarily owing to lack of transparency or lack of accessibility.