BermudaPersonal Information Protection Act 2016, application and general principles
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Use personal information only for the specific purposes it was collected for, in a fair and lawful manner, and adopt measures and policies giving effect to these obligations.NIST Privacy FrameworkGV.PO-P1
- Obtain verifiable consent from a parent or guardian before relying on consent to use a child's personal information in a service targeted at children or known to be used by a child.NIST Privacy FrameworkCT.PO-P1
- Do not use sensitive personal information, which includes biometric information and genetic information, to discriminate against any person contrary to Part II of the Human Rights Act 1981 unless there is lawful authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 6(1)(a) lets an organisation rely on consent only where it can reasonably demonstrate that the individual has knowingly consented, which cannot be shown without a record of the consent. Section 16(2)(a) asks the organisation to be reasonably satisfied that a parent or guardian's consent for a child is verifiable. Neither section says how long the record is kept or who may inspect it, and section 5(1) asks only for suitable measures and policies. Section 13 asks for safeguards subject to periodic review and reassessment, which reviews the safeguards, not a record. Section 3 applies the Act to an organisation that uses personal information in Bermuda, which is a place of use and is not one of the territorial hooks in the vocabulary, so the hook is left empty.
- Kind
- Implicit
- As of
- Provision
- Section 6(1)(a) (consent is a ground for using personal information only where the organisation can reasonably demonstrate that the individual knowingly consented); section 16(2)(a) (consent for a child's personal information must be verifiable)
- Trigger
- consent_or_optout
What this law does
The Act binds every organisation that uses personal information in Bermuda wholly or partly by automated means, excluding personal or domestic use, artistic, literary or journalistic use in the public interest, and business-contact information used to reach an individual in their capacity as an employee or official.
An organisation must adopt suitable measures and policies to give effect to its obligations, use personal information fairly and only for specified purposes, and provide privacy notices.
Where an information society service is targeted at children, or the organisation has actual knowledge it is using a child's personal information, the organisation must obtain verifiable consent from a parent or guardian before relying on consent as the basis for using it, and may not seek information about the child's parents or guardians beyond what is needed to obtain that consent.
The administrative provisions of the Act, including the Commissioner's office, came into operation on . The Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced that this Part's remaining provisions would come into operation, together with the rest of the Act's substantive provisions, on .
Use of sensitive personal information in order to discriminate contrary to Part II of the Human Rights Act 1981 is permitted only with lawful authority, which includes use for the purposes of the Beneficial Ownership Act 2025. Section 7 was amended by BR 100 / 2025 with effect from .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .