BermudaPersonal Information Protection Act 2016, breach of security notification
Personal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security)
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify the Privacy Commissioner, then any affected individual, without undue delay of a breach of security that is likely to adversely affect an individual.
- Describe in the Commissioner notification the nature of the breach, its likely consequences, and the measures taken and to be taken to address it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to notify a breach of security to the Commissioner in accordance with section 14 is an offence under section 48, liable on summary conviction, in the case of an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, in the case of a person other than an individual, to a fine not exceeding $250,000.
What it makes you log
Logging duty
Section 14 requires an organisation to notify the Commissioner and then the affected individuals of a breach of security without undue delay, and to describe the nature of the breach, its likely consequences and the measures taken, so that the Commissioner can maintain a record of the breach and the measures taken. The record kept under that clause is the Commissioner's, and nothing in the section tells the organisation to keep a record of breaches, notified or not. The section sets no territorial hook of its own.
- Kind
- None
- As of
What this law does
Where a breach of security leads to the loss, unlawful destruction, or unauthorised disclosure of or access to personal information that is likely to adversely affect an individual, the responsible organisation must, without undue delay, notify the Privacy Commissioner of the breach and then notify any individual affected.
The notification to the Commissioner must describe the nature of the breach, its likely consequences for the individual, and the measures taken and to be taken to address it, so the Commissioner can decide whether to order further steps and can maintain a record of the breach. Section 14 came into operation on , the date the Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced for the Act's remaining provisions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .