44% Had No Privacy Notice. The Privacy Commissioner Has Noticed.
Adam Wenham | Founder & Managing Director, Garrison · 12 October 2026
44% of companies reviewed had no privacy notice at all.
In June 2026, a review of 200 Bermuda companies' published privacy notices by Appleby found that 44% had no privacy notice at all. The Privacy Commissioner's own 2024 sweep of 196 organisations' websites found a privacy notice on only 78 of them, 40%. And in July 2026 the Commissioner's first annual report under full PIPA signalled a shift from education to enforcement.
Not an inadequate notice. Not a notice with gaps. No notice. In a jurisdiction where the insurance and reinsurance sector processes some of the most sensitive personal information in the global financial system — health data for life and medical malpractice policies, claims histories, financial records, employee data — that figure should concern every carrier board, regardless of whether their specific entity was assessed.
PIPA came fully into force on January 1, 2025. Eighteen months later, the Privacy Commissioner's first annual report signals that the era of education and implementation is over. Enforcement has arrived.
I spent seventeen years at Credit Suisse, where data governance was a condition of operating across multiple jurisdictions simultaneously, and four years at the Bank of England leading technology transformation and operational resilience, where operational data management sat at the heart of the work. What follows is what the shift from education to enforcement means for Bermuda's carriers — and why PIPA is not a standalone compliance exercise but the thread that connects every other regulatory obligation the BMA imposes.
Enforcement has begun, and the numbers set the baseline
The Safeguarding Bermuda 2025/2026 Annual Report — the PrivCom's first since PIPA came fully into force — covers April 2025 to March 2026. The numbers are small but significant.
Written Requests — 22 complaints and 8 requests for review
Breach Reports — Personal information breach reports filed
Enquiries — General enquiries from members of the public
Commissioner Gretchen Tucker, who assumed office in March 2026, has stated that the PrivCom is committed to ensuring organisations understand and meet their obligations while protecting the privacy rights of individuals.
The language has shifted. The PrivCom's revised mission statement, updated in 2025, now explicitly centres on regulation and enforcement, not just education. The annual report signals a transition from pre-implementation preparedness to active oversight.
The current enforcement volumes are modest — and some may take comfort from that. They should not. Every privacy regime follows the same trajectory: education, then targeted enforcement, then systematic oversight. The PrivCom is building its enforcement capability in the same way the BMA built its cyber supervisory capability — incrementally, deliberately, and with increasing reach. The carriers that use the current low volumes as a reason to delay will find themselves unprepared when the pace increases.
It is also worth noting that PIPA enforcement sits with the Privacy Commissioner, not the BMA. They are separate institutions with separate mandates. However, the BMA's own Cyber Code (Section 6.10) requires compliance with applicable privacy laws — meaning a PIPA failure is also a BMA supervisory concern. The carrier faces two regulators, not one. For the insurance sector, which handles substantial volumes of personal information across complex cross-border structures, this dual oversight has direct operational implications.
The enforcement framework itself is graduated. The Privacy Commissioner can issue compliance orders, pursue offences carrying fines of up to $250,000 for a company, conduct investigations, and require organisations to demonstrate their compliance. For a carrier processing policyholder health data across Bermuda, London, and New York through multiple third-party relationships, the exposure surface is considerable.
PIPA's obligations are broader than most carriers assume
PIPA is not Bermuda's version of GDPR. It draws its structural model from Canadian provincial privacy statutes and regulates the 'use' of personal information — a term that encompasses collection, processing, and disclosure — rather than adopting the consent-first approach of European frameworks. The intention, as the PrivCom has articulated, is to balance privacy protection with Bermuda's role as a leading international financial centre.
But for carriers, the practical obligations are substantial:
Privacy Officer
must be designated (s.5(4)), not as a title but as a function with genuine authority and resources.
Privacy impact assessments
are not required by PIPA, but are the practical way to show a new use of personal information is fair and limited to its purpose.
Privacy notices
must be published — the requirement that 44% of the companies reviewed had not met.
Third parties
remain the organisation's responsibility: it stays accountable for personal information it passes to a service provider (s.5(3)), so contracts must carry the protection.
Breaches
of security likely to adversely affect an individual must be notified to the Privacy Commissioner without undue delay, then to the individuals affected (s.14).
A data inventory
is not a PIPA requirement in itself, but without one a carrier cannot meet its notice, transfer or access-request duties.
Overseas transfers
leave the organisation responsible, so it must assess the protection the recipient gives, relying on comparable law, contract, certification or binding corporate rules (s.15).
For a Bermuda carrier that cedes risk to a London reinsurer, uses a US-based TPA for claims processing, employs an insurance manager in Hamilton, and stores data in a cloud environment managed from Dublin — that is every obligation triggered simultaneously, across multiple jurisdictions, through multiple contractual relationships.
Carriers face three challenges other firms do not
Bermuda's position in the global insurance market makes PIPA's impact uniquely significant. Members of the Association of Bermuda Insurers and Reinsurers represent approximately 36% of the global insurance and reinsurance market. The personal information flowing through Bermuda's carriers includes policyholder health records, claims data, underwriting assessments, financial information, and employee records — data categories that attract the highest sensitivity classifications under any privacy framework.
Three challenges are specific to carriers:
Cross-border transfer complexity
A Bermuda carrier routinely transfers personal information to group companies, cedants, retrocessionaires, and service providers across multiple jurisdictions. PIPA requires that cross-border transfers meet adequacy standards. Many carriers have not assessed whether their existing data flows satisfy this requirement — particularly transfers to jurisdictions without comprehensive privacy legislation. The data processing agreements with reinsurers in London may reference GDPR. The agreements with service providers in the US may reference state-level privacy laws. Neither necessarily satisfies PIPA's adequacy test, which is assessed under Bermuda's own framework.
Insurance manager data handling
Many carriers delegate significant operational functions to insurance managers — including functions that involve personal information. Under PIPA, the carrier remains the 'organisation' responsible for the personal information, regardless of which entity physically processes it. A data breach at the insurance manager is the carrier's breach. A failure to maintain processing records at the insurance manager is the carrier's failure. The outsourcing of operations does not outsource the privacy obligation.
Legacy data
Carriers hold historical policyholder data spanning decades — long-tail liability classes, legacy claims files, dormant policy records. PIPA applies to all personal information held by an organisation, not just information collected after the Act came into force. Many carriers have never conducted a data inventory that accounts for their legacy holdings. The data classification gap identified in the BMA's cyber report — 21% of entities had not completed data classification — overlaps directly with the PIPA obligation to understand what personal information you hold and where it resides.
One breach can trigger two regulators
This is where the compliance landscape becomes genuinely complex — and where treating PIPA as a standalone exercise creates the most risk.
PIPA and the Cyber Code
Section 6.10 of the BMA's Insurance Sector Operational Cyber Risk Management Code of Conduct requires that personally identifiable information be handled in accordance with applicable privacy laws. A cyber breach that compromises personal data is simultaneously a PIPA breach notification event (without undue delay) and a BMA cyber incident report. Two regulators. Two notification obligations. Two different timelines. One event.
PIPA and the OpRes Code
The new Operational Resilience and Outsourcing Code requires carriers to assess the resilience of their outsourced providers. If an outsourced provider processes personal information — and most do — the carrier's outsourcing resilience assessment must now include PIPA compliance: does the outsourcer have a Privacy Officer? Does it maintain processing records? Does it have a breach notification process that enables the carrier to meet its own obligation to notify without undue delay? The outsourcing assessment and the PIPA assessment are the same exercise conducted through different lenses.
PIPA and AI Governance
The BMA's August 2026 AI governance consultation makes explicit that AI systems processing personal data must comply with existing privacy obligations. An AI underwriting tool that ingests policyholder health data for risk assessment is a PIPA use case: the processing must have a lawful basis, the data subject has rights of access and correction, and the carrier must be able to explain how the AI used their information. The AI governance framework and the PIPA framework converge on the same data, the same processing activities, and the same accountability obligations.
PIPA and Bermuda's international credibility
As privacy commentators have noted, meaningful enforcement of PIPA is essential to Bermuda's ability to participate in the global exchange of personal information. Bermuda cannot be considered a safe harbour for the importation of personal data from GDPR-regulated jurisdictions or from Canadian provinces unless PIPA has a documented enforcement track record. For carriers that depend on cross-border data flows for their business model, PIPA compliance is not just a regulatory obligation. It is a commercial necessity.
Four actions to take before enforcement hardens
The Privacy Commissioner has signalled that enforcement activity will increase. The first annual report establishes the baseline. The next one will measure progress. Boards that act now have the opportunity to demonstrate compliance before the enforcement posture hardens further.
Four actions that should be underway:
Complete a data inventory
Before you can comply with PIPA, you must know what personal information you hold, where it resides, how it flows between jurisdictions, and who has access to it. This is the same data classification exercise the BMA's cyber report identified as incomplete at 21% of entities. One exercise satisfies both obligations.
Publish a privacy notice
If you are among the 44% that do not have one, this is your most visible compliance gap and your fastest fix. The notice must describe what personal information you collect, why you collect it, how you use it, who you share with, and how individuals can exercise their rights. Template notices copied from UK or US parent companies do not satisfy PIPA's requirements — they must reflect Bermuda's specific framework.
Review every third-party data processing agreement
Every insurance manager, TPA, cloud provider, reinsurer, and service provider that handles personal information on your behalf needs a PIPA-compliant data processing agreement. Many existing agreements predate PIPA's full enforcement and do not include the required provisions around breach notification, data return and destruction, processing limitations, and Privacy Officer contact details.
Integrate your breach response process across PIPA, the Cyber Code, and the OpRes Code
A single breach event triggers obligations under all three. Your incident response plan should have a unified workflow that addresses PIPA notification (without undue delay to the PrivCom), BMA cyber incident reporting (72 hours under the Code), and operational resilience impact assessment (under the OpRes Code). Testing this integrated workflow — not just documenting it — is what separates genuine preparedness from compliance theatre.
Good data governance satisfies every code at once
PIPA's full enforcement coincides with a broader maturation of Bermuda's regulatory environment. The OpRes Code, the Cyber Code, the AI governance guidance — all of them depend on the same foundational capability: knowing what data you hold, who processes it, how it flows, and how it is protected. A carrier that builds robust data governance to satisfy PIPA has simultaneously strengthened its position under every other regulatory instrument the BMA administers.
As Appleby's recent analysis of the Privacy Commissioner's annual report observed, the shift from education to enforcement marks a significant milestone for Bermuda's privacy regime. For carriers, the question is no longer whether PIPA will be enforced. It is whether, when enforcement comes, the evidence of compliance is genuine or performative.
Forty-four per cent had no privacy notice. The Privacy Commissioner has noticed. The question is what your board does next.
Garrison · Hamilton, Bermuda · adam@garrison.re
Practitioner analysis, not legal advice. More at garrison.re/analysis
About the author. Adam Wenham is the founder of Garrison, a Bermuda firm that provides senior technology leadership to Bermuda's regulated firms: covering technology seats, running programmes, bringing in specialists and getting firms ready for the BMA's technology codes. He led technology transformation and operational resilience at the Bank of England, held senior roles across operations, engineering, architecture, innovation and change during seventeen years at Credit Suisse, and led the technology modernisation function at StoneX. At both Credit Suisse and StoneX he led the technology side of mergers and acquisitions. He began his career at Barclays, where he ran the technology for the move of BZW's 3,500-strong investment bank and its 1,300-position dealing room to Canary Wharf. adam@garrison.re