Office of the Privacy Commissioner for Bermuda (PrivCom) is releasing statistics for Q3/2025

The Personal Information Protection Act 2016 (PIPA) came into full effect on 1 January 2025.

Please note this report is limited to reported personal information breaches, written requests, and general queries received by the PrivCom Investigations Unit during Q3 (1 July – 30 September 2025) and that some statistics may be subject to change with updated information.

Q3 Statistics Summary

Personal Information Breaches

• There were a total of five (5) reported personal information breaches during Q3. 

• All five (5) reported personal information breaches were closed by PrivCom during Q3.

• Of the five (5) personal information breaches:

  • One (1) was related to accidental disclosure of personal information.

  • Two (2) were related to internal (employee) unauthorized access of personal information.

  • Two (2) were related to external (3^rd party) unauthorized access to personal information.

Written Requests

• There were a total of nine (9) written requests received by PrivCom during Q3.

• Of the nine (9) total written requests received, three (3) were written requests asking for a Review and six (6) were written requests initiating a Complaint under PIPA. 

• Of the three (3) Reviews received:

  • One (1) was resolved informally through early resolution.

  • Two (2) are currently active and remain open.

• Of the six (6) Complaints received:

  • One (1) was determined to be invalid.

  • Three (3) were closed due to insufficient evidence.

  • Two (2) are currently active and remain open.

General Queries

• There were a total of nine (9) general queries received during Q3.

• Of the general queries received during Q3, all nine (9) were closed by PrivCom

• informally during Q3 by providing recommendations or guidance to relevant resources.

• Some of the common general queries received in Q3 included:

  • Questions relating to PIPA rights requests.

  • Concerns regarding the domestic use of personal information.

  • Concerns about unauthorized access to personal information within the workplace.

Q3 Key Takeaway

Interactions with Privacy Officers across multiple organisations during Q3 revealed a general lack of understanding of their responsibilities and obligations under PIPA, particularly with respect to managing individuals’ PIPA rights requests and appropriately communicating with our office. This highlights the need for greater organisational support and training to ensure Privacy Officers are adequately equipped to fulfill their duties.