Free · no form, no email address
PIPEDA to Bermuda PIPA: what your programme does not already cover
Ten areas where Bermuda's Personal Information Protection Act asks for something Canadian law does not. Everything else in your privacy programme travels. This is a working file, not a brochure — there are columns for you to record where you stand, and it counts itself when you are done.
Three of the ten cannot be mapped from anything you have
Most of a Canadian privacy programme transfers to Bermuda intact. Accountability, openness, safeguarding, breach response — the shapes are familiar, and where they differ it is usually a matter of a different clock or a different approver.
Three are different in kind, because Canada has no equivalent to map from:
A statutory category of sensitive personal information. Race, ethnicity, sex, sexual orientation, disability, health, religion, political opinions, trade union membership, biometric and genetic data. Explicit consent is required and implied consent does not suffice. Canadian practice treats sensitivity as contextual, which is a defensible answer in Canada and a non-answer in Bermuda. Employee health and union membership are in scope, which is the part that surprises people.
A right to deletion. Individuals may ask for their personal information to be deleted. PIPEDA has no general right of erasure, so most Canadian organisations have no erasure workflow at all — there is nothing to extend, only something to build.
An assessment before information leaves Bermuda. Before an overseas transfer you must assess the level of protection the recipient provides and secure comparable protection by contract or corporate code, and liability stays with you regardless. Note the direction that catches people out: information moving from the Bermuda entity to the Canadian parent, or to a cloud region outside Bermuda, is an overseas transfer.
What is in it
One row per area. What PIPEDA requires, what PIPA requires, the delta that bites, and the evidence a Bermuda-ready programme produces.
- Ten areas, with the PIPA section referenced for each
- Yellow columns for your verdict, an owner and a note
- A summary sheet that counts itself, with the number that matters in red
Excel. Licensed to one organisation. Twelve months of free revisions.
Canadian organisations with a Bermuda entity, office or workforce — and the people who have just been asked whether the group is covered.
- Privacy officers and general counsel at Canadian parents
- Finance and risk leads at Bermuda subsidiaries
- Anyone who has been told "our PIPEDA programme covers it"
If you cannot answer an area from documents you already hold, that is the finding.
Why we made it
Because a guide to PIPA would be a worse product. Bermuda law firms publish those, they publish them well, and they publish them free. The question a Canadian organisation actually has is narrower and nobody was answering it: what does my existing programme not already cover?
PIPA reached full implementation on 1 January 2025 and is enforced by the Office of the Privacy Commissioner for Bermuda. Offences carry fines up to $250,000 for an organisation, and directors, managers and officers can be personally liable where an offence involved their consent or connivance, or was attributable to their neglect. That last point is why this tends to belong on a board agenda rather than in a compliance backlog.
What this is not
A comparison of published obligations, not legal advice
We are an independent privacy assessment practice, not a law firm, and we are not admitted in Bermuda. This document is written to help you scope the work; questions of interpretation belong with Bermuda-qualified counsel and we will say so rather than guess. It does not assess your organisation — it gives you the questions, and it does not tell you how you answered them.
If you would rather the answers were verified than self-declared, that is an engagement, and we will tell you whether it is worth doing before you book it.
Take it
No form and no email address. We would rather you used it than gave us your contact details for it — and if it turns out you need help, you will know where we are.
Prepared by Maya Chen, who works across Canadian privacy law and Bermuda's PIPA. Her qualifications are here, and can be confirmed with the bodies that issue them.