Personal Information Protection Act 2016, cross-border transfer of personal information
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A cross border transfer rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Remain responsible for a transfer of personal information to an overseas third party complying with this Act, unless a specific exception (such as a small-scale, occasional transfer unlikely to prejudice an individual's rights) applies.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
An organisation that transfers personal information to an overseas third party, whether for use on the organisation's behalf or for the third party's own business purposes, remains responsible for that transfer's compliance with the Act. An organisation may avoid full accountability for the transfer where it reasonably assesses the circumstances and concludes the transfer is small-scale, occasional, and unlikely to prejudice the rights of an individual, among other exceptions.
The Privacy Commissioner may recommend that the Minister designate a jurisdiction as providing a comparable level of protection for section 15 purposes. The Commissioner may separately order, at the Commissioner's discretion, that an organisation be permitted to transfer personal information to an overseas third party where the organisation has reasonably demonstrated it cannot comply with the general accountability rule.
When LexLint raises it
crawls_webtrains_models
Read the law
Personal Information Protection Act 2016, Consolidated Laws of Bermuda