Bermuda: Data Protection

The IAPP Global Summit 2026 brought together privacy professionals, regulators and industry leaders from around the world to explore the evolving data protection landscape. From artificial intelligence (AI) governance to cross-border data challenges, the conference offered practical insights on how organisations can build trust, manage risk and adapt to rapid technological change.

The Personal Information Protection Act 2016 (PIPA), which came into force on 1 January 2025, represents Bermuda’s first comprehensive date protection regime. The legislation regulates the collection, use, disclosure and storage of personal information with the objective of protecting individuals’ privacy while allowing organisations to use data in a responsible and transparent manner.

The Personal Information Protection Act 2016 has been in effect for more than a year now, and employers in Bermuda are now fielding requests from their employees to access and review their employment records — all of them.

Bermuda's privacy laws and regulations concerning the protection and use of personal information in Bermuda currently exists across two different statutes. One of them, the Electronic Transactions Act 1999 ( ETA ).

As of the date of this publication (1 August 2024), data protection in Bermuda is largely comprised of a complex set of sectoral laws, regulator guidance...

The operative provisions of Bermuda's first data privacy legislation, the Personal Information Protection Act 2016 (PIPA), will come into effect from 1 January 2025. PIPA will regulate the use of personal...

The European Court of Justice (ECJ) has this morning handed down a landmark judgment in which it has ruled that the EU's Fourth AML Directive (EU2015/849) whereby Member States...

Bermuda's laws and regulations concerning the protection and use of personal information, data, and related cybersecurity risk management, currently exists across several statutes and regulations.

Increasingly, businesses in Bermuda rely on the IT and data-processing services of both domestic and overseas providers. The collection and use of personal information is a ubiquitous aspect of those services.