Data protection & privacy law in Bermuda (2026)

Legal framework

Personal Information Protection Act 2016 (PIPA), fully in force since 1 January 2025; supervised by the Office of the Privacy Commissioner for Bermuda (PrivCom).

Key points: data & privacy in Bermuda

1. 01Primary law and effective date

   The Personal Information Protection Act 2016 (PIPA) came into full force on 1 January 2025, establishing a comprehensive framework governing the use of personal information by public and private organisations in or from Bermuda.

   privacy.bm gov.bm walkersglobal.com

2. 02Supervisory authority

   The Office of the Privacy Commissioner for Bermuda (PrivCom) is the independent regulator established under PIPA. Its powers include investigating complaints, own-initiative investigations, compliance audits, compliance orders, administrative penalties, and issuing guidance and codes of practice. The current Commissioner is Gretchen Tucker, appointed by the Governor on 2 March 2026.

   privacy.bm privacy.bm gov.bm

3. 03Core organisational obligations

   Organisations must have a lawful condition for use of personal information, appoint a Privacy Officer, implement proportionate safeguards, provide privacy notices, and respond to individuals' access requests within 45 calendar days. They remain responsible for third-party processors' compliance.

   privacy.bm applebyglobal.com privacy.bm

4. 04Individual rights

   Individuals have rights of access, correction, blocking of use, and consent-withdrawal, and may seek compensation for financial loss or emotional distress caused by an organisation's failure to comply with PIPA.

   conyers.com privacy.bm

5. 05Breach notification

   Organisations must notify PrivCom and affected individuals without undue delay of any breach likely to adversely affect an individual, describing the nature of the breach, likely impact, and mitigation steps. Failure to notify a qualifying breach is a separate offence.

   privacy.bm kennedyslaw.com

6. 06Overseas transfers

   Under PIPA sections 15(2)–(3), an organisation transferring personal information to an overseas third party must assess the recipient's level of protection and the applicable foreign law; the transferring organisation remains accountable. PrivCom may recognise certification mechanisms and issue equivalency determinations over time.

   privacy.bm privacy.bm gov.bm

7. 07Penalties

   PIPA carries criminal and administrative sanctions of up to BMD $250,000 for organisations on indictment, and up to BMD $25,000 and/or up to two years' imprisonment for individuals (e.g., directors/officers) on summary conviction, in addition to PrivCom's administrative enforcement powers.

   kennedyslaw.com applebyglobal.com

Timeline of decisions

1. 2 Mar 2026Guidance · official
   Gretchen Tucker appointed Privacy Commissioner

   The Governor appointed Gretchen Tucker, effective 2 March 2026, as Bermuda's second Privacy Commissioner and the first Bermudian and first woman to hold the post, succeeding founding commissioner Alexander White. Signals continuity of PIPA enforcement under new leadership.

   Government of Bermuda

2. 20 Mar 2025Guidance
   Privacy Commissioner issues final Financial Services Guidance Notes

   Commissioner Alexander White released the finalized ~52-page Financial Services Guidance Notes after industry consultation, clarifying how PIPA applies to Bermuda's large financial-services sector. Non-binding but the authoritative reference for the sector post-implementation.

   The Royal Gazette

3. 1 Jan 2025Law · official
   Personal Information Protection Act 2016 (PIPA) takes full effect

   Bermuda's comprehensive data-protection law became fully operative, obliging all in-scope organisations to appoint privacy officers, implement security safeguards, and report personal-data breaches. Its security and breach-notification provisions form a core pillar of Bermuda's cybersecurity obligations alongside the BMA codes and the Cybersecurity Act.

   Office of the Privacy Commissioner for Bermuda (PrivCom)

4. 1 Jan 2025Law · official
   Personal Information Protection Act 2016 comes into full force

   PIPA's substantive provisions took effect, giving individuals control over personal data and imposing security/breach obligations on all organisations using personal information in Bermuda, including online platforms. It is now the backbone of Bermuda's data and online-privacy framework.

   Office of the Privacy Commissioner for Bermuda

5. 1 Jan 2025Law · official
   PIPA comes into full force

   The Personal Information Protection Act 2016 reached full operative effect, making all data-protection principles, individual rights, organisational obligations and the Commissioner's enforcement powers fully binding on all entities using personal information in Bermuda.

   Office of the Privacy Commissioner (PrivCom)

6. 1 Jan 2025Law · official
   Personal Information Protection Act (PIPA) comes into full force

   Bermuda's GDPR-style data-protection law became fully operative, regulating automated processing of personal information and giving the Privacy Commissioner enforcement powers. It is the principal statute constraining how AI systems may use personal data in Bermuda.

   Office of the Privacy Commissioner

7. 1 Nov 2024Guidance · official
   "Road to PIPA" awareness campaign launched

   PrivCom and the Government ran a public-awareness and compliance-readiness programme through 2024 to prepare organisations for full PIPA enforcement, publishing the Guide to PIPA and practical compliance checklists.

   Government of Bermuda

8. 2 Jun 2023Law · official
   Personal Information Protection Amendment Bill 2023 tabled

   The Government tabled amendments to PIPA (and related changes to the Public Access to Information Act 2010) to refine the framework ahead of full implementation, paving the way for the 2025 go-live.

   Government of Bermuda

9. 20 Jan 2020Decision · official
   Alexander White takes office as first Privacy Commissioner

   The Governor, after consultation with the Premier and Opposition Leader, appointed Alexander McD. White as Bermuda's inaugural Privacy Commissioner, standing up the Office of the Privacy Commissioner (PrivCom) as the country's data-protection authority.

   Government of Bermuda

10. 2 Dec 2016Law · official
    Office of the Privacy Commissioner provisions commenced

    Sections of PIPA enabling appointment of the Privacy Commissioner and creation of the Office, with its duties and powers, were brought into force, beginning the staged implementation of the Act.

    Office of the Privacy Commissioner (PrivCom)

11. 27 Jul 2016Law · official
    Personal Information Protection Act 2016 receives Royal Assent

    PIPA, Bermuda's foundational data-protection statute, received Royal Assent, establishing a GDPR-aligned framework of privacy principles, individual rights, breach obligations and an independent regulator that defines the country's current regime.

    Government of Bermuda

12. 3 Jul 2000Guidance · official
    Electronic commerce data-protection standard takes effect

    A Ministerial standard issued under the Electronic Transactions Act for intermediaries and e-commerce service providers came into force, operationalising Bermuda's early EU-style data protection principles for online services.

    Cybertips Bermuda (Government of Bermuda)

Sources

1. 1.privacy.bm/
2. 2.privacy.bm/guide-to-pipa
3. 3.privacy.bm/transfer-to-overseas-third-party
4. 4.privacy.bm/organisations-overseas-third-parties
5. 5.privacy.bm/post/what-is-a-privacy-officer
6. 6.privacy.bm/press-background
7. 7.gov.bm/articles/personal-information-protection-bill-2016-0
8. 8.gov.bm/articles/office-privacy-commissioner-bermuda
9. 9.gov.bm/privacy-notice
10. 10.walkersglobal.com/en/Insights/2025/01/Guide-to-Bermuda-Privacy-Law
11. 11.applebyglobal.com/publications/privacy-law-and-compliance-2025-bermuda/
12. 12.kennedyslaw.com/en/thought-leadership/article/2025/bermuda-data-breaches-and-the-new-
13. 13.conyers.com/publications/view/understanding-pipa-defining-our-individual-rights/