Guide to PIPA: Principles

Summary

This is guidance from the Bermuda Office of the Privacy Commissioner explaining the 12 core principles and rules set out in Part 2 (sections 5 to 16) of the Personal Information Protection Act (PIPA). It is informational in nature, describing the foundational obligations that underpin Bermuda's data privacy regime rather than introducing new legal requirements.

• Applies to: All organisations that use personal information in Bermuda, including those that qualify for partial PIPA exemptions.
• 12 principles cover: Responsibility and compliance, conditions for using personal information, sensitive personal information, fairness, privacy notices, purpose limitation, proportionality, integrity of personal information, security safeguards, breach of security, overseas transfers, and personal information about children.
• Minimum requirements: Sections 5 (responsibility and compliance), 8 (fairness), 11 (proportionality), 12 (integrity of personal information) and 13 (security safeguards) apply to all organisations regardless of any exemption.
• Consequence of non-compliance: Failure to comply with the principles may expose an organisation to investigation, enforcement action, or prosecution for an offence.

The guide frames these principles as the spirit rather than rigid rules of PIPA, aligning with international frameworks such as the GDPR and OECD Privacy Principles, and forming the basis for detailed compliance obligations elsewhere in the Act.

Key obligations

• Organisations using personal information must comply with the minimum requirements under PIPA sections 5, 8, 11, 12 and 13, even if otherwise exempt from other parts of the Act.
• Organisations should apply all 12 PIPA principles (sections 5 to 16) as the foundation of their data privacy practices to avoid risk of investigation, enforcement, or prosecution.

Applies to

organisations using personal information, organisations with partial PIPA exemption