This Q&A does not cover notification, registration, or authorization requirements for data processors or arising under sectoral laws. For an overview of the data protection law in Bermuda, see Data Protection in Bermuda: Overview.

Data Protection Authority

1.What is the name and contact information of Bermuda’s data protection authority or supervisory authority responsible for data protection?

The Office of the Privacy Commissioner for Bermuda was established as an independent public office in accordance with the Personal Information Protection Act 2016 (PIPA).

Notification or Registration

2. Does the country’s comprehensive data protection law require private-sector data controllers to notify or register with the data protection authority before processing personal data?

No. PIPA, which is not fully implemented, does not require data controllers to notify or register with the Privacy Commissioner before processing personal data. For more on the country’s PIPA implementation, see Data Protection in Bermuda: Overview.

Authorization

3. Does the country’s comprehensive data protection law require private-sector data controllers to seek authorization from the data protection authority before processing personal data?

General Authorization Requirements

No. PIPA, which is not fully implemented, does not require data controllers to obtain authorization from the Privacy Commissioner before processing personal data.

Cross-Border Data Transfers

PIPA does not require the Privacy Commissioner to authorize cross-border data transfers. Before transferring data outside of Bermuda, organizations should determine whether the third party provides a comparable level of protection as required by PIPA. The Privacy Commissioner can designate any jurisdiction as providing a comparable level of protection for these purposes and can also recognize a certification mechanism that, if adopted by the overseas third party, can be relied on as providing adequate protection, but has not made any of these decisions as of the date of this Q&A. If the organization  cannot rely on the overseas third party’s level of protection it must employ contractual mechanisms, corporate codes of conduct, or other means to ensure a comparable level of protection as required by PIPA. (Section 15(2), (3), (4), and (5), PIPA.) The Privacy Commissioner can approve binding corporate rules for these purposes, but has not done so as of the date of this Q&A.

The Privacy Commissioner has discretion to allow a cross-border transfer that does not comply with PIPA’s requirements if, both:

  • The organization reasonably demonstrates that is cannot complay.
  • The transfer does not undermine the individual’s rights.

(Section 29(1(I), PIPA.)

Data Protection Officers

4. Does the country’s comprehensive data protection law require private-sector data controllers to appoint a data protection officer?

Yes. Once it is fully implemented, PIPA requires organizations to appoint a data protection officer (DPO). A group of organizations under common ownership or control may appoint on DPO, if that DPO is accessible from each organization. This applies regardless of whether the organization has a presence in Bermuda. A DPO may delegate its duties to one or more individuals. (Section 5(4) to (6), PIPA)

5. If the comprehensive data protection law requires private-sector data controllers to appoint a data protection officer (DPO), do data controllers have any obligations to notify or communicate the DPO’s contact details to the data protection authority or register with the data protection authority?

PIPA, which is not fully implemented, does not require data controllers to notify or communicate the data protection officer’s contact details to the Privacy Commissioner.

First Published in Practical Law – Thomson Reuters, August 2020

Share
X.com LinkedIn Email Save as PDF
More Publications
Appleby-Website-Insurance-and-Reinsurance
1 Apr 2025

Bermuda: With everything growing, all of the ILS world will rise together

It’s been an exceptionally busy and record start to the year for the catastrophe bond sector, and ...

Appleby-Website-Employment-and-Immigration
27 Mar 2025

Entering and Exiting Bermuda for Visa-Controlled Nationals

As it stands, with direct commercial flights to and from Bermuda only going from the United Kingdom,...

Appleby-Website-Corporate-Practice
27 Mar 2025

How foreign companies become Bermuda companies

Bermuda, renowned as a global business hub, offers a robust legal and regulatory framework that attr...

Appleby-Website-Insurance-and-Reinsurance
24 Mar 2025

Bridging the USD51 trillion gap: asset-intensive reinsurance in Bermuda

In this article we examine the rise and regulatory landscape of Asset-Intensive Reinsurance (AIR) in...

Appleby-Website-Privacy-and-Data-Protection
20 Mar 2025

PIPA Guidance on Financial Services (Bermuda)

This month, the Privacy Commissioner of Bermuda released his Financial Services Guidance Notes: Fin...

IWD Grid Capture
8 Mar 2025

International Women’s Day 2025 roundtable: Rights. Equality. Empowerment.

As we recognise International Women’s Day 2025, we are reminded that gender equality is not just a...

Corporate
28 Feb 2025

Bermuda Monetary Authority’s proposed resilience code

The Bermuda Monetary Authority, which well understands the operational risks associated with financi...

Dispute Resolution
25 Feb 2025

Bermuda: An Introduction to Dispute Resolution 2025

The stable, competitive regulatory and legal regime in Bermuda continues to ensure its place as a hu...

Appleby-Website-Banking-and-Financial-Services
19 Feb 2025

Recent Updates on BVI, Cayman and Bermuda laws

Entities incorporated or registered in the British Virgin Islands (BVI), Cayman Islands and Bermuda ...

Appleby-Website-Employment-and-Immigration
18 Feb 2025

Fostering Respect: the Importance of Bullying and Sexual Harassment Policies in Bermuda (Part 2)

Under the Employment Act 2000 (EA), it is a requirement for an employer to not only have a compliant...