Section 15 Checklist for Organisations

Summary

This is a self-assessment checklist issued by Bermuda's Office of the Privacy Commissioner (PRIVCOM) to help organisations document compliance with Section 15 of the Personal Information Protection Act (PIPA) when transferring personal information to overseas third parties. It sets out the steps an organisation should confirm and record before making such a transfer.

• Identify applicable laws: Confirm the personal information protection laws and regulations that apply in the overseas third party's jurisdiction.
• Assess protection level: Before transferring, assess whether the overseas third party provides a level of protection comparable to PIPA, and identify which permitted scenario applies (Minister's designation, own comparative assessment, recognised certification mechanism, contractual mechanisms, corporate codes of conduct, other equivalent means, or an exceptional circumstance such as legal necessity or small-scale/occasional transfer).
• Conduct due diligence: Carry out due diligence on the overseas third party's practices to ensure ongoing compliance with PIPA responsibilities.

The checklist itself does not set new legal rules but operationalises existing PIPA Section 15 requirements, prompting organisations to record their reasoning and chosen transfer mechanism for accountability purposes.

Key obligations

• Identify the personal information protection laws and regulations applicable in the overseas third party's jurisdiction before any transfer.
• Assess the level of protection the overseas third party provides and identify which permitted transfer scenario under Section 15 applies before engaging in an overseas transfer.
• Where protection is not comparable, employ contractual mechanisms, binding corporate codes of conduct, or other effective means to ensure a comparable level of protection, or establish that an exceptional circumstance applies.
• Conduct due diligence on the overseas third party's practices to ensure ongoing compliance with PIPA.

Applies to

organisations subject to PIPA transferring personal information to overseas third parties