Data Privacy Notice

Last Updated: 21 November 2025

The Bermuda Corporate Income Tax Agency (CITA) is committed to protecting your privacy and ensuring that your personal information is collected, used, and stored securely and in compliance with the Personal Information Protection Act 2016 (PIPA) and other applicable data protection laws and regulations. This Privacy Notice explains how we collect, use, share and safeguard your personal information when you interact with the Agency. This Privacy Notice does not form part of a contract (if any) with the Agency and does not confer any contractual right on you or place any contractual obligation on us.

How We Collect Your Personal Information

Most of the personal information that we hold will have been provided by you (for example, when applying for employment or creating an online tax administration account). The information in this Privacy Notice is an addition to any information provided to you at the point of collection.

Where you provide to us personal information of a third party, you must be authorised to share such personal information with us and we presume that you have obtained the consent of that third party where applicable.

What Information We Collect

The Agency may collect the following types of information when you interact with us, including but not limited to:

Personal information – Name, contact details, identification numbers and other details required for employment or tax administration.
Financial & tax-related data – Business registration details, corporate tax filings, payment history and compliance records.
Technical data – IP addresses, browser type and website usage analytics collected through cookies and tracking technologies.
Communications & correspondence – Emails, queries and interactions with our team.

Only when it is required will we collect sensitive personal information from you, at which time we will obtain your consent to use it and will use it solely for the purpose for which it was provided to us. Examples of sensitive personal information which the Agency may require includes, but is not limited to, your place of origin as set out in your passport and your medical information as it may pertain to your employment with the Agency.

Who May Have Access or Receive Your Information

Personal information may be disclosed to the following individuals and/or entities as required for employment, tax administration and compliance with applicable law:

Agency employees – While undertaking their official duties and as reasonably necessary in human resources, compensation and benefits, tax administration, compliance and enforcement.
Government agencies & regulatory bodies – To fulfill legal obligations, tax compliance and regulatory reporting.
Law enforcement authorities – If required by law, court order or regulatory investigations.
Third-party service providers – For IT support, security, and operational purposes, ensuring compliance with Bermuda or comparable data protection laws.
International tax authorities – In accordance with information exchange agreements and international compliance requirements.

How We Use Your Information

We will use your personal information in a lawful and fair manner. The Agency uses your personal information to:

Administer employment and Agency personnel related matters.
Administer and enforce corporate income tax in Bermuda.
Provide taxpayer support and services.
Ensure compliance with tax regulations and international agreements.
Enhance security, detect fraud and prevent tax evasion.
Improve website functionality and user experience.
Where otherwise reasonably necessary in exercising the Agency's official authority.

We only collect and use personal information when it is lawful, necessary and relevant to the purpose for which it was provided.

How We Share Your Information

The Agency may share your information in the following circumstances:

With government agencies & regulatory bodies – To fulfil legal obligations and facilitate tax compliance.
With law enforcement authorities – If required by law, court order or regulatory investigations.
With third-party service providers – For IT support, security and operational purposes, ensuring compliance with Bermuda or comparable data protection laws.
With international tax authorities – In accordance with information exchange agreements and international compliance requirements.

We do not use, share, sell, rent, or trade your personal information to third parties for the purposes of direct marketing or otherwise.

International Transfers of Personal Information

Where your personal information is transferred to a third party located outside of Bermuda, we will confirm that the recipient complies with data protection laws which are comparable to PIPA so that your personal information is adequately protected and transferred in accordance with PIPA requirements.

Data Retention & Security

The Agency retains your data, including personal information, only for as long as necessary to fulfil legal and administrative requirements.
We use appropriately secure systems, encryption, and access controls to protect your data against unauthorised access, destruction, use, modification, disclosure or other misuse.
We regularly review our data protection measures to maintain security and compliance.
Our employees, contractors and agents are bound by confidentiality obligations when handling your personal information, and they may be subject to disciplinary measures if they fail to comply with these obligations.

Your Rights & How to Access Your Information

Under PIPA, you have the right to submit a reasonable written request to us to:

Request access to your personal information in our custody or control, the purposes for which we have been or are using your personal information, and the names of persons or types of persons and circumstances for which your personal information has or is being disclosed.
Correct or update any inaccuracies in your information.
Request deletion of your personal information where it is no longer relevant for the purposes of its use (where legally permissible).
Restrict or object to use of your personal information for the purposes for which it was provided.
Withdraw consent (if our use is based on express consent).

Requests for access, correction, erasure or to object to use of personal information shall be addressed in accordance with PIPA. To exercise your rights or make a privacy-related request, please complete the Agency’s Personal Information Request Form, which can be located on its website or by clicking the link HERE and submit it to PATI-PIPArequest@cita.bm .

Contacting Us & Our Privacy Officer

Our offices are located at Wellesley House South, 1st Floor, Pembroke, HM08, Bermuda.
If you have any questions about this Privacy Notice or to request more details about how to make a request, please contact:
Megan Colley
Legal Director and Privacy Officer
at: PATI-PIPArequest@cita.bm or (441)543-8660

Cookies & Tracking Technologies

The Agency’s website uses cookies to improve functionality and user experience. For more details on how we use cookies, refer to our Cookies Policy and Cookies Preference page.

Changes to This Privacy Notice

The Agency may update this Privacy Notice periodically. Any significant changes will be communicated through our website. The date above indicates when this Privacy Notice was last revised.