Bermuda

Section 182F makes it an offence to knowingly make, print or publish child abusive material or child pornography, liable on conviction on indictment to ten years' imprisonment or on summary conviction to five years, and a separate offence to knowingly distribute, transmit, make available, sell, import or export such material, carrying the same penalties.

Child pornography is defined as a photograph, film, video or other visual representation, whether or not made by electronic or mechanical means, that shows a child who is, or is depicted as being, engaged in explicit sexual activity, or whose dominant characteristic is the depiction, for a sexual purpose, of a sexual organ or the anal region; the definition does not require the depicted child to be a real, identifiable individual, so a computer-generated or AI-synthesised depiction meeting it can fall within the ban. For sections 182C to 182H, "child" means a person under the age of sixteen.

Where a breach of security leads to the loss, unlawful destruction, or unauthorised disclosure of or access to personal information that is likely to adversely affect an individual, the responsible organisation must, without undue delay, notify the Privacy Commissioner of the breach and then notify any individual affected.

The notification to the Commissioner must describe the nature of the breach, its likely consequences for the individual, and the measures taken and to be taken to address it, so the Commissioner can decide whether to order further steps and can maintain a record of the breach. Section 14 came into operation on 1 January 2025, the date the Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced for the Act's remaining provisions.

The Act binds every organisation that uses personal information in Bermuda wholly or partly by automated means, excluding personal or domestic use, artistic, literary or journalistic use in the public interest, and business-contact information used to reach an individual in their capacity as an employee or official.

An organisation must adopt suitable measures and policies to give effect to its obligations, use personal information fairly and only for specified purposes, and provide privacy notices.

Where an information society service is targeted at children, or the organisation has actual knowledge it is using a child's personal information, the organisation must obtain verifiable consent from a parent or guardian before relying on consent as the basis for using it, and may not seek information about the child's parents or guardians beyond what is needed to obtain that consent.

The administrative provisions of the Act, including the Commissioner's office, came into operation on 2 December 2016. The Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced that this Part's remaining provisions would come into operation, together with the rest of the Act's substantive provisions, on 1 January 2025.

Use of sensitive personal information in order to discriminate contrary to Part II of the Human Rights Act 1981 is permitted only with lawful authority, which includes use for the purposes of the Beneficial Ownership Act 2025. Section 7 was amended by BR 100 / 2025 with effect from 3 November 2025.

An organisation that transfers personal information to an overseas third party, whether for use on the organisation's behalf or for the third party's own business purposes, remains responsible for that transfer's compliance with the Act. An organisation may avoid full accountability for the transfer where it reasonably assesses the circumstances and concludes the transfer is small-scale, occasional, and unlikely to prejudice the rights of an individual, among other exceptions.

The Privacy Commissioner may recommend that the Minister designate a jurisdiction as providing a comparable level of protection for section 15 purposes. The Commissioner may separately order, at the Commissioner's discretion, that an organisation be permitted to transfer personal information to an overseas third party where the organisation has reasonably demonstrated it cannot comply with the general accountability rule.

Section 15 came into operation on 1 January 2025, the date the Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced for the Act's remaining provisions.

An individual may request access to personal information an organisation holds about them, subject to exemptions including for information that would prejudice medical treatment. An individual may request correction, blocking, erasure or destruction of personal information containing an error or omission.

An individual who suffers financial loss or emotional distress from an organisation's failure to comply with the Act is entitled to compensation, determined by the court, unless the organisation proves it took such care as was reasonably necessary to comply. Sections 17 to 20 came into operation on 1 January 2025, the date the Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced for the Act's remaining provisions.

The Privacy Commissioner for Bermuda, a public office appointed by the Governor, investigates complaints, mediates disputes, and on completing an inquiry may make an order requiring an organisation to give access, rectify or destroy personal information, or take other steps to remedy a breach of the Act. The Commissioner's office and general powers came into operation on 2 December 2016.

The Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced that the review, complaint, order, judicial review and offences provisions in this range would come into operation, together with the rest of the Act's remaining provisions, on 1 January 2025.

A person who fails to comply with a Commissioner's order or notice, contravenes the sensitive-personal-information restriction, destroys evidence during an investigation, or fails to notify a breach of security, commits an offence liable on summary conviction, for an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, for a person other than an individual, to a fine not exceeding $250,000.

Section 7(1) defines sensitive personal information as any personal information relating to an individual's place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinions, trade union membership, biometric information or genetic information.

Section 7(2) bars an organisation from using sensitive personal information, without lawful authority, in order to discriminate against any person contrary to any provision of Part II of the Human Rights Act 1981.

Under section 7(3), use of sensitive personal information is with lawful authority only if and to the extent it is used with the consent of the individual concerned, in accordance with an order of the court or the Commissioner, for criminal or civil proceedings, in recruitment or employment where the nature of the role justifies such use, or for the purposes of the Beneficial Ownership Act 2025.

The Minister may by order, subject to the negative resolution procedure, amend the definition of sensitive personal information in section 7(1). The condition in section 6(1)(b), which turns on what a reasonable person would consider, does not apply to sensitive personal information. Section 7 was amended by BR 100 / 2025 with effect from 3 November 2025.

The Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced that the Act's remaining provisions, section 7 among them, would come into operation on 1 January 2025.

Section 3 makes it an offence for a person, knowing the access is unauthorised, to cause a computer to perform any function with intent to secure access to a program or data held in any computer, whether or not the intent is directed at a particular program, data or computer. Access is unauthorised only if the person is not entitled to control access of that kind and lacks the consent of someone who is, so authorisation rather than a technical measure is what the Act tests.

Section 4 aggravates the offence where the unauthorised access is committed with intent to commit or facilitate a further indictable offence. Section 5 separately criminalises unauthorised modification of computer material, and section 6A unauthorised conduct causing a computer to cease to function permanently or temporarily. The provisions this entry describes came into force on different days. Its date of assent is recorded as 1 July 1996.

The Interpretation Act 1951 provides that, absent an express commencement date or a commencement notice, an Act comes into operation on the day it is assented to.

A property right, database right, subsists in a database where there has been a substantial investment in obtaining, verifying or presenting its contents, regardless of whether the database or its contents is also a copyright work.

The right is infringed by extracting or re-utilising all or a substantial part of a database's contents without the owner's authority, subject to exceptions for parliamentary and judicial proceedings, material open to public inspection under a statutory requirement, and material communicated to the Crown in the course of public business. The Copyright Tribunal has jurisdiction over disputed licensing schemes and licences for database right, on the same terms as for copyright licensing.

The Digital Asset Business (Cybersecurity) Rules 2018 (BR 99 / 2018) are made by the Bermuda Monetary Authority in exercise of the power conferred by section 7 of the Digital Asset Business Act 2018. Rule 3 requires every licensed undertaking to file annually with the Authority a written report prepared by its Chief Information Security Officer.

The Rules define the Chief Information Security Officer as the senior executive appointed by the licensed undertaking to oversee and implement its cyber security program and enforce its cyber security policies. Rule 4(1)(a) requires the cyber security program to include penetration testing and vulnerability assessment of the licensed undertaking's electronic systems at least on a quarterly basis.

Rule 4(2) requires every licensed undertaking to engage a qualified independent party to audit its systems and provide a written opinion to the Authority. Section 39 of the Act makes a person who fails to comply with a requirement imposed by or under the Act liable to a civil penalty not exceeding $10,000,000 for each failure.

Section 7 of the Act makes a licensed undertaking that fails to file information or documents required in relation to a Rule within the time specified liable to a civil penalty not exceeding $5,000 for each week or part of a week in default. Section 7 of the Act requires a licensed undertaking to file those Rule documents not later than four months after the close of its financial year.

The Insurance Sector Operational Cyber Risk Management Code of Conduct applies to all Bermuda registered insurers, insurance managers and intermediaries. Section 2BA of the Insurance Act 1978 requires every registered person to comply with the provisions of any code of conduct applicable to it that the Authority issues. A failure by a registered person to comply with such a code is taken into account by the Authority in determining whether the business is being conducted in a prudent manner.

The Insurance Sector Operational Cyber Risk Management Code of Conduct requires the board of directors to approve a cyber risk policy document at least on an annual basis. The Insurance Sector Operational Cyber Risk Management Code of Conduct requires registrants to be in compliance by 31 December 2021.

Paragraph 2 of the Operational Cyber Risk Management Code of Conduct requires each relevant licensed entity to implement adequate systems, appropriate to the nature, scale and complexity of its business risk profile. Section 8A of the Banks and Deposit Companies Act 1999 requires every institution to comply with any code of conduct the Authority issues.

A failure by a bank to comply with such a code is taken into account by the Authority in determining whether its business is being conducted in a prudent manner. The Operational Cyber Risk Management Code of Conduct requires the board to approve a cyber risk policy at least annually. The Operational Cyber Risk Management Code of Conduct requires the Chief Information Security Officer role to be filled by an appropriately qualified staff member or a similarly experienced outsourced resource.

The Operational Cyber Risk Management Code of Conduct requires banks and deposit companies to comply by 15 February 2023.

The Cybersecurity Act 2024 lets the Minister, after consulting the Board and the appropriate CNII enforcement authority, designate an entity as a CNII entity if the entity is listed as an entity providing an essential service under the sector of a CNII enforcement authority. A CNII enforcement authority and any CNII entity to which a policy direction applies must act in accordance with the policy direction.

The Cybersecurity Act 2024 lets the Minister issue codes of practice or minimum standards of performance for CNII entities. The Cybersecurity Act 2024 lets regulations require a CNII enforcement authority or entity to report significant cybersecurity event threats, vulnerabilities and events to the relevant CNII enforcement authority and the National Cybersecurity Incident Response Team.

The Cybersecurity Act 2024 comes into operation on such day as the Minister may appoint by notice published in the Gazette.

Section 20(1) requires a senior representative to notify the Authority forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that an event to which section 20 applies has occurred. Section 20 requires the senior representative, within 14 days of that notification, to furnish the Authority with a written report setting out all the particulars of the case that are available to him.

Section 20 includes a cyber reporting event in a list of events with a material change to the business of the licensed undertaking. Section 2 of the Act defines a cyber reporting event as any act that results in unauthorized access to, disruption, or misuse of the electronic systems or information stored on such systems of a licensed undertaking, in the circumstances the definition lists.

Section 19 requires every licensed undertaking to appoint a senior representative who is a person approved by the Authority. Section 39 of the Act makes a person who fails to comply with a requirement imposed by or under the Act liable to a civil penalty not exceeding $10,000,000 for each failure. The Digital Asset Business Amendment Act 2023 repealed and replaced the definition of cyber reporting event with effect from 9 June 2023.

The Insurance Sector Operational Cyber Risk Management Code of Conduct requires a Principal Representative or appropriate officer to notify the Authority within 72 hours of a determination or confirmation of a cyber reporting event, whichever is sooner. The Insurance Sector Operational Cyber Risk Management Code of Conduct requires an incident report to be submitted within 14 days of the initial incident notification date.

The Insurance Sector Operational Cyber Risk Management Code of Conduct requires only cyber reporting events with significant adverse impact on operations, policyholders or clients to be reported to the Authority.

The Operational Cyber Risk Management Code of Conduct requires an officer of a licensed entity to notify the Authority within 72 hours of a determination or confirmation of a cyber reporting event, whichever is sooner. The Operational Cyber Risk Management Code of Conduct requires an incident report to be submitted within 14 days of the initial incident notification date.

The Operational Cyber Risk Management Code of Conduct requires only cyber reporting events with significant adverse impact on the entity's operations or clients to be reported to the Authority. The Operational Cyber Risk Management Code of Conduct requires incident investigation and response logs to be kept for a minimum of five years.

Section 3(1)(d) makes it an offence to publish an obscene article to, or in the presence of, a person under the age of sixteen years. "Publishes" is defined to include distributing, circulating, selling, letting on hire, giving or lending a thing, or showing, playing or projecting a thing containing matter to be looked at or a record.

The same section separately bars importing an obscene article, publicly publishing one, or having one for publication for gain, and section 2(3) deems a thing obscene if it is child abusive material or child pornography within the meaning of Part X of the Criminal Code. A defendant is not convicted if they prove they had not examined the article and had no reasonable cause to suspect it was obscene. The provisions this entry describes came into force on different days.

The Interpretation Act 1951 provides that, absent an express commencement date or a commencement notice, an Act comes into operation on the day it is assented to.

Fair dealing with a work for the purpose of criticism or review, of that or another work or of a performance of a work, does not infringe copyright provided it is accompanied by sufficient acknowledgement.

Fair dealing with a work, other than a photograph, for the purpose of reporting current events likewise does not infringe copyright provided it is accompanied by sufficient acknowledgement, except that no acknowledgement is required when current events are reported by sound recording, film, broadcast or cable programme. The Act carries no broader exception permitting wholesale reproduction of a newspaper or periodical article on a current topic.