Guidance Note: Transfer of Personal Information to Overseas Third Parties and Comparable Jurisdictions

Summary

This is a guidance note from Bermuda's Office of the Privacy Commissioner (PrivCom) explaining how organisations should comply with section 15 of the Personal Information Protection Act 2016 (PIPA) when transferring personal information to overseas third parties (recipients not domiciled in Bermuda). It sets out how PrivCom will assess whether a foreign jurisdiction's law is 'comparable' to PIPA for purposes of Ministerial designation, and gives organisations the same framework to make their own reasonable-belief assessments when no designation exists.

• General duty: Under section 5(3), organisations remain responsible for PIPA compliance whenever they share personal information with any third party, and must perform due diligence on the recipient's practices.
• Overseas transfer duty: Under section 15, before transferring personal information to an overseas third party, organisations must assess whether the law applicable to the recipient provides a comparable level of protection to PIPA.
• Three routes to proceed: Organisations may proceed with an overseas transfer only by (1) reasonably concluding the applicable law is comparable (including relying on a Ministerial designation or a recognised certification mechanism), (2) using safeguarding mechanisms such as contractual clauses or corporate rules, or (3) identifying an applicable legal exception.
• Comparability criteria: A law is more likely to be treated as comparable if it matches PIPA's scope and definitions, aligns with PIPA's 12 general principles, provides the four individual rights (access, correction, blocking, erasure), limits exemptions to reasonable grounds, and has effective enforcement and redress mechanisms.
• Tools provided: PrivCom has published a 'Template for Section 15 Analysis of Comparable Laws' and a 'Section 15 checklist for Organisations' to help organisations document jurisdiction assessments and vendor evaluations.
• Ongoing obligations: Even after choosing a transfer route, the organisation remains responsible for PIPA compliance, including giving appropriate privacy notice (including about the overseas transfer and any certification mechanism relied on) and meeting all other PIPA conditions and safeguards.

The note is explanatory and does not itself impose new deadlines; it clarifies existing section 15 obligations and provides practical tools organisations can use to document and support their transfer assessments.

Key obligations

• Organisations must perform due diligence on any third party recipient of personal information to ensure ongoing PIPA compliance (section 5(3)).
• Before transferring personal information to an overseas third party, organisations must assess whether the law applicable to the recipient provides a level of protection comparable to PIPA (section 15(1)-(2)).
• To proceed with an overseas transfer, organisations must either reach a reasonable conclusion the recipient's law is comparable, employ a safeguarding mechanism such as contractual clauses or corporate rules, or identify an applicable legal exception (section 15(3)-(6)).
• Organisations must identify all jurisdictions to which they transfer personal information, determine comparability of applicable law, and evaluate whether the overseas recipient can be trusted to comply with PIPA standards (three-step checklist).
• Organisations must continue to provide individuals with appropriate privacy notices, including disclosure of overseas transfers and reliance on any certification mechanism, and must continue to meet all other PIPA obligations regardless of the transfer route chosen.

Applies to

organisations subject to PIPA, organisations transferring personal information to overseas third parties