PIPA and AI: Bermuda's Privacy Law for AI Systems

Bermuda's Personal Information Protection Act 2016 (PIPA) is the law that applies to more AI systems in Bermuda than any other. It came fully into force on 1 January 2025, and it covers any organisation that uses personal information in Bermuda, whether a person or a model does the using. This Laurenceo guide explains how PIPA applies to AI, where the risks sit, and what to put in place.

Does PIPA Apply to AI?

Yes, whenever personal information is involved. PIPA does not mention artificial intelligence, but it regulates the use of personal information by organisations, and AI systems use personal information constantly:

training or fine-tuning a model on customer, patient or employee records;
pasting client details into a generative AI tool such as ChatGPT;
a chatbot or voice assistant that collects names, policy numbers or health details;
AI that screens job applicants, scores credit or prices insurance;
AI meeting notes and call transcription;
AI-generated images or video of real people.

PIPA Obligations, Mapped to AI

PIPA obligation	What it means for an AI system
Lawful condition for use	Identify the condition (for example consent, contract or legitimate interest) for each AI use of personal data, including training
Privacy notice	Tell people their information will be used by AI, for what purpose, before or when it is collected
Proportionality	Use no more personal data than the AI use case needs; avoid feeding whole records into prompts
Integrity and accuracy	Check AI outputs about people; inaccurate AI-generated records breach the accuracy duty
Security safeguards	Protect data in prompts, logs, vector stores and model memory; control which tools staff may use
Overseas transfers	Most AI vendors process data abroad; you stay responsible and must ensure comparable protection
Individual rights	People can ask to access and correct their information, including what an AI system holds about them
Privacy officer	Every organisation must designate a privacy officer, who should be involved in AI decisions
Breach notification	AI incidents that expose personal data, such as a leaked prompt log, may need notifying to the Commissioner and affected people

The Privacy Commissioner's Guide to PIPA sets out each obligation in full.

Using Overseas AI Tools

Most generative AI services run outside Bermuda. Under PIPA, an organisation is not relieved of its obligations when a third party, including an overseas third party, processes data for it (DLA Piper). Before staff use an AI tool with personal data, check where data is processed, whether prompts are used to train the vendor's models, how long data is kept, and whether the contract gives comparable protection. Enterprise plans with training switched off and data residency options make this much easier.

Penalties

Organisations convicted of an offence under PIPA face fines of up to $250,000; individuals face fines of up to $25,000, imprisonment for up to two years, or both (DLA Piper). Appleby has also highlighted that directors can be liable for PIPA compliance failures.

What the Privacy Commissioner Has Said About AI

The Office of the Privacy Commissioner (PrivCom) has not yet issued AI-specific guidance under PIPA. It has signed the Global Privacy Assembly's joint statement on AI-generated imagery, and it issued financial services guidance notes in 2025 (Mondaq). The Bermuda Business Development Agency's fintech materials describe a privacy sandbox, PINK, run with PrivCom for testing new technologies (BDA).

Where PIPA Meets the BMA's AI Guidance

For regulated financial firms, PIPA and the BMA's proposed AI Guidance Note overlap: responsible and ethical data use is one of the BMA's eight principles. Laurenceo's consultation response recommends connecting AI incident records directly to PIPA breach assessment, so that the same evidence answers both.

A PIPA Checklist for AI

List every AI tool and use case that touches personal information.
Record the lawful condition for each, including model training.
Update privacy notices to mention AI use.
Approve which AI tools staff may use with personal data, and block the rest.
Redact or minimise personal data before it reaches a model.
Check vendors: processing location, training on your data, retention, contract terms.
Keep a process for access and correction requests that covers AI outputs.
Treat AI data leaks as potential breaches and assess them promptly.
Involve your privacy officer in every new AI deployment.

Laurenceo's free AI Policy Gap Analyzer checks an AI policy against PIPA and the BMA's guidance, and the Evidence Toolkit builds an AI inventory with data sensitivity ratings.

Questions and Answers

Can I use ChatGPT with client data in Bermuda?

Only with care. Putting client personal information into a public AI tool is a use and likely an overseas transfer under PIPA. Use an approved enterprise tool with training switched off, minimise the data, and make sure your privacy notice and contracts cover it.

Does PIPA give a right to object to automated decisions?

PIPA does not have a GDPR-style article on automated decision-making, but its general obligations still apply: a lawful condition, transparency, accuracy and the rights of access and correction. The Government's own AI Policy requires human review of AI decisions affecting people.

Who enforces PIPA in Bermuda?

The Privacy Commissioner for Bermuda, through the Office of the Privacy Commissioner (PrivCom).

Is there AI-specific privacy guidance in Bermuda?

Not yet. As of November 2026, PrivCom has not published AI-specific guidance, so organisations apply PIPA's general obligations to AI.

PIPA and AI