Privacy notice | PrivComBermuda

Privacy Notice: The Office of the Privacy Commissioner for Bermuda

Last updated: 29 January 2026

The Office of the Privacy Commissioner for Bermuda (“PrivCom”) is responsible for the use of any personal information an individual (“you”) submits to PrivCom.

PrivCom shall ensure that any personal information provided by you in the course of satisfying its regulatory obligations under the Personal Information Protection Act 2016 (“PIPA”) will be used in accordance with PrivCom’s privacy notice. This privacy notice explains how PrivCom uses personal information in accordance with PIPA.

This privacy notice is dated 29 January 2026 and was previously updated on 16 March 2023.

This privacy notice is kept under regular review and updated as required. PrivCom may change this privacy notice from time to time.

PrivCom encourages individuals to review this privacy notice periodically to stay informed about PrivCom’s personal information handling practices and how PrivCom protects individuals’ personal information.

You can download the document in PDF format here.

The organisation using your personal information is the Office of the Privacy Commissioner for Bermuda (“PrivCom”).

PrivCom is mandated to regulate the use of personal information by organisations in Bermuda.

You can contact PrivCom by the following means:

Mail: Maxwell Roberts Building, 4th floor, 1 Church Street, Hamilton, HM11

Phone: 543-7748

Email: Privcom@privacy.bm

If you wish to report a breach of privacy caused by an organisation, email Investigations@privacy.bm

Most of the personal information PrivCom uses is provided by you based on your consent [section 6(1)(a)], for example when you:

fill in an online form to sign up for training and events hosted by PrivCom,
make an inquiry;
submit a service or a speaker request form,
provide your personal information to PrivCom by email or over the phone;
attend PrivCom’s office as a drop-in;
apply for employment with PrivCom.

PrivCom shall use your personal information for the purpose of satisfying its regulatory obligations under PIPA where your personal information is needed by law, or to support a rights request under PIPA, for example when you:

submit a written request to PrivCom, or
report a breach.

PrivCom shall use your personal information in compliance with:

sections 6(1)(c)(i)-(ii): the use of the personal information is necessary for the performance of a contract the individual is party to; or for the taking of steps at the request of the individual with a view to entering into contract;
section 6(1)(d): the use of the personal information is pursuant to a provision of law that authorises such use;
section 6(1)(e): the personal information is publicly available and will be used for a purpose that is consistent with the purpose of its public availability;
section 6(1)(g): the performance of a task carried out in the public interest or in the exercise of official authority vested in the organisation or in a third party to whom the personal information is disclosed;
section 6(1)(h):in the context of an individual’s present, past or potential employment relationship with the organisation.

PrivCom may collect or be incidentally in receipt of personal information relating to individuals from other sources.

PrivCom may also obtain personal information from other sources including publicly available sources.

PrivCom compiles and publishes statistics but never in a form that would identify any individual.

The third-party organisations to which PrivCom may disclose your personal information include:

All necessary Bermuda government departments;
Office of the Auditor General and internal government auditors for purposes related to the audit;
Accountant General’s Office for the purpose of processing payments to third party vendors;
Director of Public Prosecutions for purposes related to the commission of an offence under PIPA;
Bermuda courts for the purpose of conducting legal proceedings for a violation of PIPA;

The following organisations PrivCom has a contract with include:

Wix for the purpose of providing webhosting;
Oxygen for the purpose of providing IT services;
CAS Ltd for the purpose of providing case management systems for investigations;
2 Tech Ltd. for the purpose of providing building access and security;
Consultant Kendra Mello for investigations (during the course of investigations, for example handling a review or a complaint.)

PrivCom may transfer personal information to the following overseas third parties:

Wix for the purpose of providing webhosting;
Oxygen for the purpose of providing IT services;
CAS Ltd for the purpose of providing case management systems for investigations;
Kendra Mello for the purpose of investigations.

PrivCom does not share any personal information with third parties for the purposes of direct marketing.

In accordance with PIPA, you have the right to:

request access to the personal information that an organisation holds on you;
have your personal information corrected;
have your personal information blocked;
have your personal information erased/destroyed.

Some legal exemptions or exclusions may apply. This means that you may not always be able to exercise the above rights under PIPA.

If you have a concern regarding your rights and/or wish to submit a PIPA rights request, contact PrivCom’s Privacy Office at PO@privacy.bm

PrivCom’s Website Privacy Notice

This website is intended to provide you with information about the activities undertaken by the Office of the Privacy Commissioner (PrivCom) in the course of satisfying its regulatory obligations under PIPA. The website does not collect personal information from you unless you complete a form to enrol in our training activities and/or events .

The hosting platform of PrivCom’s website (www.privacy.bm), Wix, is a third party that may collect some personal information from you.

Information provided to PrivCom

Whenever you communicate with PrivCom, such as by using the information at the Contact Us page, PrivCom may make a record of your identity and the nature of your communication in order to respond to a request, investigate a complaint (e.g., create a case file), or track statistics.

Where you have registered for the purpose of attending training, an event, or requested a service or a speaker using your full name, email address, and/or your phone number, access to this personal information is available to PrivCom through our hosting platform. We do not plan to use the information for any other purpose (other than contacting you in relation to the event you have registered for).

Website data usage

This website may collect some information from you as you browse, such as your IP address, where you are located geographically, what site linked you to ours, or other details.

Wix analytics collects information about how visitors use our website. We use the information to compile reports and to help us improve the website. We collect information including the number of visitors to the website, where visitors have come to the website from, the pages they visited, and which pages are visited most often.

Collected logs and the information contained therein are not disclosed to anyone except those authorised to administer the server and PrivCom’s network. Log files can be used to generate collective summaries of statistics to aid in administration and/or the production of reports. The information is collected and used in a way that does not directly identify anyone. Our goal is for the site to collect no more information than is necessary for the site to technically function.

Cookies on PrivCom’s website

Wix websites use “cookies”. Cookies are small pieces of data stored on a website visitor’s browser. They are typically used to keep track of the settings users have selected and actions they have taken on the site. Wix websites utilise both essential and non-essential cookies to support website functionality, enhance user experience, and perform analytics.

Cookies used on PrivCom’s website do not store any personal information or other information collected from users.

Links to other sites and social media

This website contains links to other sites, particularly to the sites of other public offices or to social media sites administered by PrivCom. These websites have their own privacy notices that are different from the one stated here. If you choose to follow those links, please remember to check the privacy notices at those sites. This privacy notice applies only to the practices of PrivCom and www.privacy.bm.

Changes

In the event of a change to the applicable privacy notice, appropriate modifications will be made to the above provisions.