When the substantive provisions of Bermuda's Personal
Information Protection Act 2016 (PIPA) become operational on 1
January 2025, it is vital that all in scope organisations ensure
their compliance with PIPA.
This guide outlines key do's and don'ts for
organisations preparing for PIPA, from assessing whether the
legislation applies to them, to implementing safeguards and
adhering to proper data handling practices. By taking these steps
organisations ensure a smooth transition to being in
compliance.
Do's
1. Determine whether your organisation is in scope of
PIPA legislation
Consider if your organisation is using personal information in
Bermuda. “Personal information” is defined as any
information about an identified or identifiable individual (i.e. a
natural person, whether they are explicitly identified by name or
where their identity is identifiable from the information, such as
their social insurance number). “Use” (and
“using”) in relation to personal
