In the first part of this series we discussed why data and privacy legislation has developed and its purpose. We also provided a brief introduction to Bermuda’s privacy legislation, the Personal Information Protection Act 2016 (“PIPA”). While the substantive provisions of PIPA have not yet come into force, many organisations have already begun the process of getting “PIPA-prepared”. Indeed, the Privacy Commissioner and his team have been providing helpful community outreach and guidance to assist with this process. However, it understandably remains a challenge to know where to begin.
Before being able to establish any privacy program, an organisation needs to first understand whether PIPA applies to it and what personal information it is holding or has control over. Essentially they need to conduct an “information inventory”. This is not as scary as it sounds but does require management to consider a number of factors.
