Cybersecurity regulation in Bermuda (2026)

Bermuda's comprehensive data-protection law became fully operative, obliging all in-scope organisations to appoint privacy officers, implement security safeguards, and report personal-data breaches. Its security and breach-notification provisions form a core pillar of Bermuda's cybersecurity obligations alongside the BMA codes and the Cybersecurity Act.

Issued by the BMA under the Digital Asset Business Act 2018, the Code required all licensed digital-asset businesses to be fully compliant by this date with a proportionate technology/cyber-risk programme and board-level cyber governance. It extended sector-specific cyber rules to crypto and DLT firms.

Passed by the Legislature on 31 May 2024, the Act creates a national regime overseen by a single Minister to set cybersecurity standards for Critical National Information Infrastructure (CNII) across health, telecoms, emergency services and energy, and establishes a Cybersecurity Advisory Board. It marks Bermuda's first economy-wide critical-infrastructure cyber law beyond the financial sector.

The Government announced the firm date for PIPA to come fully into force, giving organisations an ~18-month preparation window to build data-security and breach-reporting compliance programmes. It ended years of uncertainty over when Bermuda's data-protection regime would actually bite.

Banks, deposit companies, trust companies, investment businesses, fund administrators, money service businesses and corporate service providers had to be fully compliant with the BMA's operational cyber-risk code by this date. It brought most of Bermuda's BMA-regulated financial entities under formal cyber-governance and 72-hour incident-reporting duties.

The BMA extended its cyber-risk framework beyond insurance to corporate service providers, trust companies, money service businesses, investment businesses and fund administrators (and, via amendments to the Banks and Deposit Companies Act 1999, to banks). It standardised board oversight, a CISO function, and incident reporting across the wider financial sector.

The first BMA cyber code took effect, with insurers, insurance managers and intermediaries required to comply by 31 December 2021. It mandated board-approved cyber-risk policies, a CISO role, and notification to the BMA within 72 hours of a confirmed cyber event — the template for all later sector codes.

Bermuda's earliest digital-economy statute legally facilitated e-commerce and included EU-style data-protection principles (never fully activated), laying the conceptual groundwork for later information-security and privacy regulation. It remains the historical starting point for Bermuda's IT and data-handling law.