PIPA Is Fully In Force – Now What?

On 1 January 2025, the Personal Information Protection Act 2016 (PIPA) came fully into force in Bermuda. Applauded by the international and local data protection communities alike, PIPA is intended to create a balance between the need to protect the informational privacy rights of the individual and the need for organisations to use their personal information for appropriate purposes.

PIPA is not the "equivalent" of the data protection frameworks of the European Union (EU) or the United Kingdom (UK) and does not adopt the concepts of "controller" & "processor". Notably, there is no statutory right to use personal information for a "legitimate interest" purpose. PIPA, however, is not intended to operate in isolation from global data protection frameworks and adopts privacy standards from the EU, Canada and the Cayman Islands. These standards have been "Bermudianised" to provide a lighter regulatory approach by reducing some of the traditional regulatory