Secure your organization's data workflows and
build trust with your customers.
The Personal Information Protection Act (PIPA) of 2016 is a law passed by the government of Bermuda. It sets the requirements for the proper use of personal information by organizations while also highlighting individuals' rights concerning this usage.
Although introduced in July 2016, the act will take full effect starting on Jan. 1, 2025 and will be enforced by independent compliance officials within the region of Bermuda.
According to PIPA, all organizations will be subject to the
following principles:
Every organization must adopt suitable measures to fulfill its obligations and protect the rights of individuals.
Personal information must be used with the consent of the individual in such a way that the organization can demonstrate that the individual has consented.
Sensitive personal information must be used in a lawful, nondiscriminatory manner.
Organizations must identify valid, lawful grounds for using personal information.
Organizations must provide clear, easily accessible statements on their policies with respect to personal information.
Organizations can only use personal information according to the specified purposes.
Organizations must ensure that the personal information collected is adequate, relevant, and not excessive for the purposes for which it was collected.
Organizations must ensure that any personal information used is accurate and up to date to the extent necessary for the purposes of use.
Organizations must protect all personal information with appropriate safeguards against loss, unauthorized access, or misuse.
In the event of a breach of security, organizations must carry out the stipulated precautionary measures without delay.
In the event of personal information transfers to an overseas third party, the organization remains responsible for compliance with this act.
With ManageEngine's comprehensive suite of IT management solutions, you can ensure
that compliance requirements concerning information collection, information security,
and audits are met with the utmost care and attention to detail.
Appoint an information officer who will bear the responsibility of ensuring compliance when it comes to data processing and collection. Ensure that the data subject provides written consent to the processing of their data.
Identity and access management tools help establish role-based access controls so that only authorized personnel can handle sensitive data.
Access Manager Plus
Create custom roles with preset permissions to ensure users have only the access required to perform their tasks.
M365 Manager Plus
Establish role-based access controls for Microsoft 365 administration.
Endpoint Central
Grant the permissions of your choice based on multiple predefined and/or tailor-made roles using role-based access controls.
AD360
Select any combination of management, auditing, reporting, and alerting tasks concerning AD and Microsoft 365, then delegate them by creating custom help desk roles.
Collect and store only the data that is required for specific, lawful purposes. Ensure that the processing of this data is done through lawful means.
Locate and delete junk data, including obsolete and duplicate files, using data discovery tools.
DataSecurity Plus
Identify anomalous data access, collection, modification, and deletion. Locate and delete junk data, including stale, duplicate, and orphaned files.
Endpoint Central
Grant the permissions of your choice based on multiple predefined and/or tailor-made roles using role-based access controls.
Limit access to sensitive personal information to only the authorized stakeholders who are tasked with processing the information.
Use a real-time alert mechanism to get notified about unauthorized access to, modifications of, or deletions of files with confidential information.
Endpoint Central
Keep personal and corporate data separate on your devices. Delete users' personal data from your servers, revoking access to that data.
Password Manager Pro
Prevent unauthorized users from exploiting privileged access to personal data repositories.
DataSecurity Plus
Identify users with full control access to files shared on Windows devices. Locate all files and folders shared with multiple users.
PAM360
Ensure that only authorized users can remotely access sensitive data for specific time periods.
Endpoint DLP Plus
Designate applications as trusted so that all sensitive data from these apps is labeled sensitive.
Identify valid, lawful grounds under PIPA for using personal information.
Schedule regular scans and audits to monitor the integrity of data and periodically delete outdated data.
DataSecurity Plus
Detect and respond to sensitive data leaks through real-time monitoring.
Endpoint DLP Plus
Consolidate and categorize personal information through predefined templates and custom mechanisms.
Have documents on organizational policies and practices regarding personal data management readily available for individuals to view and comprehend.
Maintain full transparency when it comes to privacy policies and practices. Have dedicated pages on your company's website that clearly list the data security and privacy best practices that your company follows.
Collect, store, and process data only for specific purposes and only with the consent of the data subject.
Locate and delete junk data, including obsolete and duplicate files, using data discovery tools.
Endpoint Central
Keep personal and corporate data separate on mobile devices. Delete personal data from your servers and revoke access to that data.
Password Manager Pro
Prevent unauthorized users from exploiting privileged access to personal data repositories.
ADAudit Plus
Enable real-time Windows AD auditing, logon and logoff auditing, and Windows Server auditing.
DataSecurity Plus
Find users with full control access to your Windows shares and locate the files and folders shared with everyone.
PAM360
Ensure that only authorized users can remotely access sensitive data for specific periods of time.
The information you collect and store should be accurate, complete, and not misleading. It should only be updated when necessary.
A real-time alert mechanism can alert you to unauthorized access to, modifications of, or deletions of files with confidential data.
Endpoint Central
Schedule device scans to ensure the availability and integrity of personal data.
DataSecurity Plus
Monitor and delete outdated or incorrect data.
Browser Security Plus
Scan active browsers to ensure the protection of data.
Access Manager Plus
Create context-rich logs of user sessions and instantly send SNMP traps and syslog messages to SIEM tools to support compliance audits.
The data you collect must be stored in an organized manner, kept up to date, and held only for the duration of the purposes for which it was collected.
Data discovery tools can help you locate data promptly and delete or modify data upon request.
Log360
Audit databases to determine how long data has been stored and delete personal information once the storage threshold is reached.
DataSecurity Plus
Identify where personal and sensitive data is stored to facilitate further processing.
Endpoint DLP Plus
Scan endpoints within your network for quick data modifications or deletions upon request.
Take technical and organizational measures to ensure the integrity, confidentiality, and security of the collected data.
Detect vulnerabilities and external attacks using log management tools and perform RCA on breaches using log forensics.
Log360
Detect potential external threats and more using Log360's real-time correlation engine. Conduct RCA with its intuitive log search engine.
Patch Manager Plus
Scan endpoints to detect missing patches and automate the deployment of tested patches.
EventLog Analyzer
Audit all changes to personal data and all activities on systems that store personal data. Send timely alerts to data protection officers whenever the integrity of the data is being compromised.
DataSecurity Plus
Audit file and folder actions and maintain audit trails of access attempts. Trigger instant alerts to admins when suspicious activities are detected. Contain and delete ransomware infections to prevent data loss.
Endpoint DLP Plus
Limit data access to essential, relevant personnel based on their security clearance and task-specific requirements.
Notify the proper authorities of the full details of any security breach and the measures that your organization will implement to mitigate the breach.
Detect, investigate, and respond to security threats using sophisticated threat detection and mitigation solutions.
Log360
Assess the impacts of security incidents by conducting post-attack analysis and identify attack patterns to stop future attacks.
DataSecurity Plus
Proactively detect and shut down the spread of ransomware attacks. Detect attacks and threats and automate immediate responses to them.
You must only transfer data out of Bermuda to those states and territories that ensure protection for the rights and freedoms of the data subjects.
Monitor, authorize, or block data activities, including the movement of data between devices, to identify potential breaches ahead of time and ensure data security.
Endpoint Central
Set alerts in case a device does not check in with the server for a predefined period of time.
Log360
Centralize and correlate security data to identify potential data breaches instantly.
DataSecurity Plus
Monitor and block the movement of personal data to USB devices or as email attachments. Reduce incident response times with instant alerts. Generate alerts and reports on unwanted access or anomalies in file access and modifications. Maintain a document of all file and folder deletion actions.
Endpoint DLP Plus
Configure policies to restrict the movement of sensitive information to peripheral devices.
Talk to our experts to get more information on how your organization can
meet the PIPA compliance mandate.
Fully complying with PIPA requires a variety of solutions, processes, people, and technologies. The solutions mentioned above are some IT management tools that can help with some of the act's requirements. Coupled with other appropriate solutions, processes, and people, ManageEngine's solutions can help you achieve and sustain compliance with the act. This material is provided for informational purposes only and should not be considered as legal advice for PIPA compliance. ManageEngine makes no warranties, express, implied, or statutory, as to the information in this material.
