Personal Information Protection Act 2016, application and general principles
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Use personal information only for the specific purposes it was collected for, in a fair and lawful manner, and adopt measures and policies giving effect to these obligations.
- Obtain verifiable consent from a parent or guardian before relying on consent to use a child's personal information in a service targeted at children or known to be used by a child.
- Treat biometric information and genetic information as sensitive personal information requiring heightened handling.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act binds every organisation that uses personal information in Bermuda wholly or partly by automated means, excluding personal or domestic use, artistic, literary or journalistic use in the public interest, and business-contact information used to reach an individual in their capacity as an employee or official.
An organisation must adopt suitable measures and policies to give effect to its obligations, use personal information fairly and only for specified purposes, and provide privacy notices.
Where an information society service is targeted at children, or the organisation has actual knowledge it is using a child's personal information, the organisation must obtain verifiable consent from a parent or guardian before relying on consent as the basis for using it, and may not seek information about the child's parents or guardians beyond what is needed to obtain that consent.
The administrative provisions of the Act, including the Commissioner's office, came into operation on 2 December 2016; the remaining provisions commence on a day the Minister appoints by notice in the Gazette, which is not reproduced in the text read, and the Personal Information Protection Amendment Act 2023 brought amendments to most of the Act's substantive sections into effect on 1 January 2025.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_biometrics
Read the law
Personal Information Protection Act 2016, Consolidated Laws of Bermuda