Bermuda Privacy Commissioner Signals Shift to Stronger PIPA Enforcement
The Office of the Privacy Commissioner (PrivCom) has issued its first annual report since Bermuda’s Personal Information Protection Act 2016 (PIPA) came fully into force, with the reports content signaling a transition from education and implementation to a stronger focus on enforcement.
The Safeguarding Bermuda 2025/2026 Annual Report, covering April 1, 2025, to March 31, 2026, outlines the PrivCom’s first full year overseeing compliance with PIPA and indicates that organisations should expect increased regulatory activity as Bermuda’s privacy framework continues to mature.
During the reporting period, the PrivCom received 30 written requests, including 22 complaints and eight requests for review, along with 25 personal information breach reports and 43 general enquiries from members of the public.
While many matters were resolved through early intervention, the report makes clear that the PrivCom has now established the systems, investigative processes and regulatory framework needed to carry out its enforcement mandate.
“The first year of PIPA implementation has been a period of learning, engagement and capacity building,” the report states, adding that the PrivCom is now positioned to advance compliance through both guidance and regulatory oversight.
The report says enforcement is a core strategic priority alongside public education, improved compliance outcomes and organisational development. It also highlights continued investment in investigative capability, staff training and governance as the PrivCom prepares for its next phase.
Privacy Commissioner Gretchen Tucker, who assumed office in March 2026, said the PrivCom is committed to ensuring organisations understand and meet their obligations under PIPA while protecting the privacy rights of individuals.
The report notes that Bermuda is still in the early stages of building a culture of privacy, but says organisations are expected to move beyond awareness and demonstrate meaningful compliance with the legislation.
The annual report follows the completion of PIPA’s first full year in force and marks a significant milestone for Bermuda’s privacy regime, with the PrivCom signaling that enforcement activity is set to play an increasingly prominent role going forward.
