BermudaPersonal Information Protection Act 2016, sensitive personal information
Personal Information Protection Act 2016 (Bermuda), 2016:43, s. 7 (sensitive personal information)
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Privacy Commissioner for Bermuda
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not use sensitive personal information, meaning personal information relating to an individual's place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinions, trade union membership, biometric information or genetic information, to discriminate against any person contrary to Part II of the Human Rights Act 1981 without lawful authority.
- Use sensitive personal information for such a purpose only with the individual's consent, under an order of the court or the Commissioner, for criminal or civil proceedings, in recruitment or employment where the nature of the role justifies it, or for the purposes of the Beneficial Ownership Act 2025.
- Do not rely on the section 6(1)(b) condition, which turns on what a reasonable person would consider, to use sensitive personal information.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening section 7 (sensitive personal information) is an offence under section 48(2)(c), liable on summary conviction, in the case of an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, in the case of a person other than an individual, to a fine not exceeding $250,000. It is a defence for the organisation or individual charged to prove that it acted reasonably in the circumstances that gave rise to the offence.
Penalty structure
Section 48(3) caps an individual's summary-conviction fine at $25,000 (or two years' imprisonment, or both); a person other than an individual faces a fine on conviction on indictment not exceeding $250,000. The Act states amounts in Bermuda dollars, at par with the US dollar.
- Rule
- Fixed only
- As of
- Currency
- BMD
- Fixed cap
- 250,000
What it makes you log
Logging duty
Section 7 bars using sensitive personal information to discriminate without lawful authority, and lists the grounds of lawful authority, led by the individual's consent. It does not require an organisation to keep or produce a record of that consent or of the use, and no clause of the section names a log. Section 3 applies the Act to an organisation that uses personal information in Bermuda, which is a place of use and is not one of the territorial hooks in the vocabulary, so the hook is left empty.
- Kind
- None
- As of
What this law does
Section 7(1) defines sensitive personal information as any personal information relating to an individual's place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinions, trade union membership, biometric information or genetic information.
Section 7(2) bars an organisation from using sensitive personal information, without lawful authority, in order to discriminate against any person contrary to any provision of Part II of the Human Rights Act 1981.
Under section 7(3), use of sensitive personal information is with lawful authority only if and to the extent it is used with the consent of the individual concerned, in accordance with an order of the court or the Commissioner, for criminal or civil proceedings, in recruitment or employment where the nature of the role justifies such use, or for the purposes of the Beneficial Ownership Act 2025.
The Minister may by order, subject to the negative resolution procedure, amend the definition of sensitive personal information in section 7(1). The condition in section 6(1)(b), which turns on what a reasonable person would consider, does not apply to sensitive personal information. Section 7 was amended by BR 100 / 2025 with effect from .
The Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced that the Act's remaining provisions, section 7 among them, would come into operation on .
When LexLint raises it
When your app profile says your app handles health records, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .