Guide to PIPA: Key Definitions

Summary

This is a plain-language guidance page from the Bermuda Privacy Commissioner explaining who PIPA (the Personal Information Protection Act) applies to and outlining basic definitional concepts, including scope, exemptions, and minimum compliance requirements. It is explanatory in nature and does not itself create new legal rules beyond restating PIPA's structure.

• Scope: PIPA applies to every organisation that uses personal information in Bermuda, including obligations to maintain records of personal information and processing activities, and legal liability for breaches.
• Overseas third parties: Organisations remain responsible for compliance even when using overseas third parties, and must ensure contracts with such third parties comply with PIPA.
• Excluded activities: PIPA does not apply, in whole or in part, to law enforcement processing, national security uses, artistic/literary/journalistic uses for publication in the public interest, and personal or domestic purposes.
• Three compliance levels: Full compliance (PIPA applies fully); partial exemption under sections 22, 24 and 25 (minimum requirements still apply); and no compliance required for uses excluded under section 4.
• Minimum requirements: Defined as the requirements under sections 5 (Responsibility and compliance), 8 (Fairness), 11 (Proportionality), 12 (Integrity of personal information), and 13 (Security safeguards).

The page also briefly defines privacy as a human right referencing the UN Universal Declaration of Human Rights and the European Convention on Human Rights, and points readers to a separate guidance note on use of personal information by organisations in Bermuda for further detail.

Key obligations

• Organisations using personal information in Bermuda must maintain records of personal information and processing activities.
• Organisations must ensure contracts with overseas third parties comply with PIPA when personal information is transferred or processed by such third parties.
• Organisations subject to partial exemption under sections 22, 24 or 25 must still comply with the minimum requirements (sections 5, 8, 11, 12 and 13).

Applies to

organisations that use personal information in Bermuda