Bermuda PIPA,
in plain English.

Someone needs to keep privacy work moving, answer questions and coordinate requests. Designate a privacy officer and support them with clear policies and a practical privacy programme.

In practice: Make sure staff know who to contact before sharing information in a new way.

Write down what personal information you hold, why you need it, where it lives and who receives it. Include the everyday tools that are easy to overlook.

In practice: Check email, spreadsheets, booking forms, cloud folders and paper files.

Be clear about the PIPA condition that allows each use of personal information. Consent is one possible condition, but it is not the only one. Where consent is required, make it clear and meaningful.

In practice: Do not assume permission to fulfil an order also covers unrelated marketing.

Explain what you use information for, who it may be shared with and how people can exercise their rights. Keep your privacy notices understandable and aligned with what the business actually does.

In practice: Review the notice when you introduce a new form, service or supplier.

Have a process for requests to see, correct, block or erase personal information, subject to the applicable rules and exceptions. Know how to recognise a request, verify the person and meet the relevant deadline.

In practice: An access request can arrive in an ordinary email, not just on your preferred form.

Ask for information because you need it for a clear purpose. Use it fairly and within permitted purposes rather than collecting extra details just in case.

In practice: If a contact form only needs a name and email address, question why it asks for a date of birth.

Keep information accurate and up to date to the extent needed for its use. Give staff a straightforward way to correct mistakes.

In practice: Update an outdated customer address before sending documents containing personal information.

Decide how long different records need to be kept, taking legal requirements into account. When they are no longer needed, dispose of them securely rather than leaving them in forgotten folders.

In practice: Give customer records, recruitment files and old exports their own retention decisions.

Some information requires additional care. Check the rules for sensitive personal information and for information about children, including the specific requirements for online services.

In practice: Review who can access health information and what a child-facing service collects.

Choose protection based on the sensitivity of the information, how it is used and the harm that loss or misuse could cause. Review those choices as the business changes.

In practice: A folder of medical records needs a different level of care from a public brochure.

Give people their own accounts and only the access they need. Use appropriate multifactor authentication, or MFA, to add a second check when signing in.

In practice: Remove access promptly when someone leaves or changes roles.

Keep software updated, use secure settings and maintain suitable endpoint protection. This applies to the laptops, phones and other systems used for business.

In practice: Assign someone to check that security updates actually installed.

Consider how information is stored, sent, shared and destroyed. Digital files and paper records both matter.

In practice: Check a recipient before emailing a sensitive attachment and use a secure sharing method.

Give staff clear guidance on handling personal information, spotting suspicious messages and reporting mistakes quickly. Training should relate to their actual work.

In practice: Make it easy to report a misdirected email or lost device immediately.

Understand which providers handle personal information and where it goes. Assess overseas recipients and ensure transfers meet the applicable PIPA protection requirements.

In practice: Check cloud storage, payroll, booking and marketing providers, including relevant subcontractors.

Keep protected backups and test whether you can restore the information the business needs. A successful backup message alone does not prove recovery will work.

In practice: Restore a sample of important files and check that they open and are usable.

Plan how to contain, assess and document a breach. Where a breach involving personal information is likely to adversely affect an individual, PIPA requires notification to the Commissioner, then affected individuals, without undue delay.

In practice: Keep an escalation contact list and record what happened, the likely effects and the response.

Privacy work needs periodic review. Keep a record of what you checked, what needs to change, who owns the action and when it will be reviewed.

In practice: Revisit access, suppliers and safeguards when you change systems or launch a service.