BermudaPersonal Information Protection Act 2016, cross-border transfer of personal information
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Remain responsible for a transfer of personal information to an overseas third party complying with this Act, unless a specific exception (such as a small-scale, occasional transfer unlikely to prejudice an individual's rights) applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 15 keeps the organisation responsible for personal information it sends to an overseas third party and requires it to assess the level of protection the third party provides before the transfer, relying on a Minister's designation, a recognised certification, contracts or binding corporate rules. It does not tell the organisation to record or log the assessment or the transfer, and it sets no audit, access or retention rule. The section has no territorial hook of its own.
- Kind
- None
- As of
What this law does
An organisation that transfers personal information to an overseas third party, whether for use on the organisation's behalf or for the third party's own business purposes, remains responsible for that transfer's compliance with the Act. An organisation may avoid full accountability for the transfer where it reasonably assesses the circumstances and concludes the transfer is small-scale, occasional, and unlikely to prejudice the rights of an individual, among other exceptions.
The Privacy Commissioner may recommend that the Minister designate a jurisdiction as providing a comparable level of protection for section 15 purposes. The Commissioner may separately order, at the Commissioner's discretion, that an organisation be permitted to transfer personal information to an overseas third party where the organisation has reasonably demonstrated it cannot comply with the general accountability rule.
Section 15 came into operation on , the date the Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced for the Act's remaining provisions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .