Cybersecurity law & regulation in Bermuda (2026)

Legal framework

Cybersecurity Act 2024 (assented 24 June 2024, commencement staged); Computer Misuse Act 2024; BMA Insurance Sector Operational Cyber Risk Management Code of Conduct (2020); Personal Information Protection Act 2016 (PIPA, in force 1 January 2025). Oversight split between the Minister of National Security / Cybersecurity Advisory Board (CNII), the Bermuda Monetary Authority (financial sector), and the Privacy Commissioner (PrivCom) for personal-data breaches.

Key points: cybersecurity in Bermuda

1. 01Cybersecurity Act 2024 (CNII regime)

   Passed by Parliament on 31 May 2024 and given Royal Assent on 24 June 2024. It empowers the Minister of National Security, advised by a Cybersecurity Advisory Board, to designate Critical National Information Infrastructure and appoint sector 'enforcement authorities' (expected to include the Regulatory Authority for telecoms/electricity, the Bermuda Health Council, and the Bermuda Airport Authority). No general commencement date has been gazetted, so obligations bite as sectors are brought in.

   gov.bm parliament.bm dataguidance.com

2. 02BMA Insurance Sector Cyber Code of Conduct

   The Bermuda Monetary Authority's Insurance Sector Operational Cyber Risk Management Code of Conduct came into force on 1 January 2021 and applies to all registered insurers, insurance managers, agents, brokers and marketplace providers. Boards must approve a cyber-risk policy annually, and 'significant cyber reporting events' must be notified to the BMA within 72 hours, with a detailed incident report within 14 days.

   bma.bm www2.deloitte.com pwc.com

3. 03PIPA breach notification (in force 2025)

   The Personal Information Protection Act 2016 came fully into force on 1 January 2025 and is enforced by the Office of the Privacy Commissioner (PrivCom). Organisations must notify PrivCom and affected individuals without undue delay of any personal-information breach likely to adversely affect an individual; PrivCom publishes quarterly breach statistics.

   kennedyslaw.com privacy.bm privacy.bm

4. 04Computer Misuse Act 2024 (cybercrime)

   The Computer Misuse Act 2024 was passed by the House of Assembly on 17 May 2024, replacing the 1996 statute. Modelled on UK law and aligned to the Council of Europe (Budapest) Convention on Cybercrime, it recasts and enhances criminal offences for unauthorised access to, modification of, and interference with computer systems.

   applebyglobal.com royalgazette.com bernews.com

5. 05Trigger: September 2023 Government cyber-attack

   The 2024 cybersecurity legislative package was driven by lessons learned from the September 2023 ransomware-style attack on Government of Bermuda systems, which prompted the creation of the Cybersecurity Advisory Board and the acceleration of the CNII framework.

   gov.bm gov.bm royalgazette.com

6. 06Sector authorities & CNII designation

   Once the Cybersecurity Act's CNII provisions are operational, the Regulatory Authority (telecoms and electricity), the Bermuda Health Council (healthcare), and the Bermuda Airport Authority (aviation) are expected to be the primary sector 'enforcement authorities' setting cyber standards and receiving incident reports for their respective CNII operators.

   mondaq.com symptai.com lexology.com

Timeline of decisions

1. 30 Jun 2024Guidance · official
   Digital Asset Business Operational Cyber Risk Management Code of Practice becomes effective

   Issued by the BMA under the Digital Asset Business Act 2018, the Code required all licensed digital-asset businesses to be fully compliant by this date with a proportionate technology/cyber-risk programme and board-level cyber governance. It extended sector-specific cyber rules to crypto and DLT firms.

   Bermuda Monetary Authority

2. 24 Jun 2024Law · official
   Cybersecurity Act 2024 receives Royal Assent

   Passed by the Legislature on 31 May 2024, the Act creates a national regime overseen by a single Minister to set cybersecurity standards for Critical National Information Infrastructure (CNII) across health, telecoms, emergency services and energy, and establishes a Cybersecurity Advisory Board. It marks Bermuda's first economy-wide critical-infrastructure cyber law beyond the financial sector.

   Parliament of Bermuda

3. 24 Jun 2024Law · official
   Cybersecurity Act 2024 receives Royal Assent

   Passed by the Legislature on 31 May 2024 and assented on 24 June 2024, the Act sets operational cyber-security standards across critical infrastructure and essential services, a direct response to the 2023 government cyberattack.

   Government of Bermuda Official Gazette

4. 17 May 2024Law
   Computer Misuse Act 2024 passed by House of Assembly

   The new Act repeals and replaces the Computer Misuse Act 1996, modernising cybercrime offences and sharply increasing penalties, and is the first step toward Bermuda meeting the Budapest Convention on Cybercrime.

   The Royal Gazette

5. 15 Feb 2023Guidance · official
   Compliance deadline for the BMA Operational Cyber Risk Management Code (non-insurance sectors)

   Banks, deposit companies, trust companies, investment businesses, fund administrators, money service businesses and corporate service providers had to be fully compliant with the BMA's operational cyber-risk code by this date. It brought most of Bermuda's BMA-regulated financial entities under formal cyber-governance and 72-hour incident-reporting duties.

   Bermuda Monetary Authority

6. 15 Mar 2022Guidance · official
   BMA publishes Operational Cyber Risk Management Code for trust, investment and other regulated sectors

   The BMA extended its cyber-risk framework beyond insurance to corporate service providers, trust companies, money service businesses, investment businesses and fund administrators (and, via amendments to the Banks and Deposit Companies Act 1999, to banks). It standardised board oversight, a CISO function, and incident reporting across the wider financial sector.

   Bermuda Monetary Authority

7. 1 Jan 2021Guidance · official
   Insurance Sector Operational Cyber Risk Management Code of Conduct comes into force

   The first BMA cyber code took effect, with insurers, insurance managers and intermediaries required to comply by 31 December 2021. It mandated board-approved cyber-risk policies, a CISO role, and notification to the BMA within 72 hours of a confirmed cyber event, the template for all later sector codes.

   Bermuda Monetary Authority

Sources

1. 1.gov.bm/theofficialgazette/notices/gn06052024
2. 2.parliament.bm/admin/uploads/bill/5771f5da86b521a9845666812ee4e861.pdf
3. 3.gov.bm/articles/cyber-security-update
4. 4.gov.bm/articles/update-cybersecurity-advisory-board
5. 5.bma.bm/viewPDF/documents/2025-12-19-17-00-21-2025-Cyber-Risk-Management-Repo
6. 6.privacy.bm/guide-to-pipa
7. 7.privacy.bm/post/office-of-the-privacy-commissioner-for-bermuda-privcom-is-releas
8. 8.dataguidance.com/news/bermuda-parliament-passes-cybersecurity-act-2024
9. 9.applebyglobal.com/publications/bermudas-cybersecurity-law-transformation-is-well-underw
10. 10.royalgazette.com/local-business/business/article/20240613/bermudas-it-law-transformati
11. 11.mondaq.com/security/1475944/cybersecurity-for-critical-national-information-infr
12. 12.kennedyslaw.com/en/thought-leadership/article/2025/bermuda-data-breaches-and-the-new-
13. 13.www2.deloitte.com/content/dam/Deloitte/bm/Documents/risk/bermuda/BMA-InsuranceSector-Op
14. 14.pwc.com/bm/en/insurance/assets/operational-cyber-risk-code-of-conduct.pdf
15. 15.bernews.com/2024/05/new-legislation-aims-to-strengthen-cybersecurity/
16. 16.royalgazette.com/politics/news/article/20240504/lessons-learnt-from-cyberattack-includ
17. 17.symptai.com/resources/insights/cyber-security/safeguarding-bermuda-an-overview-of
18. 18.lexology.com/library/detail.aspx?g=21809ee6-ceec-4b4b-9596-9fbb20c922f3