Pipa Enhances M&A Personal Information Protocols

The article discusses the implications of Bermuda's Personal Information Protection Act 2016 (Pipa) on M&A transactions, emphasizing the act's governance over the handling and sharing of personal information. Under Pipa, the disclosure of personal data, such as customer and employee information, for due diligence purposes is regulated through specific agreements. These agreements, such as NDAs or memorandums of understanding, must respect the confidentiality and proprietary nature of the information, ensuring its use only for transactional purposes. If the transaction does not proceed, the information must be destroyed or returned. Pipa allows the use of personal information without individual consent when tied to business transactions under regulated conditions, but prohibits unrestricted sharing or retention post-transaction. Additionally, the article notes that these provisions do not apply if the main transaction goal is the exchange of personal information. It also emphasizes compliance for information transfer outside Bermuda, aligning export activities with section 15 of Pipa. Legal experts, Duncan Card and Karim Creary of Appleby, offer further insights into the legal considerations and urge standardized agreement reviews to align with Pipa’s requirements.