The Personal Information Protection Act, 2016 Is Now In Force In Bermuda

On 1 January 2025, the Personal Information Protection Act, 2016 ("PIPA"), finally came into full force and effect in Bermuda.

PIPA is Bermuda's equivalent of the UK's Data Protection Act, 1998, and the EU's General Data Protection Regulation (EU) 2016/679 (or "GDPR"). It applies to all "organisations" in Bermuda. The primary purposes of PIPA are to regulate the:

• collection;
• use;
• safeguarding; and
• access to;

personal information about individuals used by organisations in Bermuda, in a manner that respects an individual's right to privacy.

To achieve these aims, PIPA requires organisations to:

• provide individuals with "privacy notices" which state the purpose for which the personal information is being collected and provide other details;