Personal Information Protection Act 2016, Commissioner, enforcement and offences
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
An enforcement supervision rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Comply with an order or notice served by the Privacy Commissioner under this Act.
- Do not contravene the sensitive personal information restriction, and do not dispose of, alter, falsify, conceal or destroy evidence during a Commissioner investigation or inquiry.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to comply with a Commissioner order or notice, contravening section 7 (sensitive personal information), destroying evidence during an investigation, or failing to notify a breach of security under section 14, is an offence liable on summary conviction, for an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, for a person other than an individual, to a fine not exceeding $250,000.
Penalty structure
Section 48(3) caps an individual's summary-conviction fine at $25,000 (or two years' imprisonment, or both); a person other than an individual faces a fine on conviction on indictment not exceeding $250,000. The Act states amounts in Bermuda dollars, at par with the US dollar.
- Rule
- Fixed only
- As of
- 7 September 2026
- Currency
- BMD
- Fixed cap
- 250,000
Who enforces it
Enforcement body
Privacy Commissioner for Bermuda
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Privacy Commissioner for Bermuda, a public office appointed by the Governor, investigates complaints, mediates disputes, and on completing an inquiry may make an order requiring an organisation to give access, rectify or destroy personal information, or take other steps to remedy a breach of the Act.
The Commissioner's office and general powers came into operation on 2 December 2016; the offences and penalties provisions are not among the sections the Act's endnote names as having commenced on that date, and their own commencement day is not reproduced in the text read.
A person who fails to comply with a Commissioner's order or notice, contravenes the sensitive-personal-information restriction, destroys evidence during an investigation, or fails to notify a breach of security, commits an offence liable on summary conviction, for an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, for a person other than an individual, to a fine not exceeding $250,000.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot
Read the law
Personal Information Protection Act 2016, Consolidated Laws of Bermuda