Bahrain
SubstantialPersonal Data Protection Law No. 30 of 2018 (PDPL)
Authority: Ministry of Justice | Enforcement: Active | Enacted: August 2019
Overview
Bahrain's PDPL came into effect in August 2019. It is one of the most comprehensive data protection laws in the Gulf region, covering consent, data subject rights, cross-border transfers, and breach notification.
14-Topic Coverage
Data Protection Authority
Fully AddressedMinistry of Justice oversees compliance with support from the Personal Data Protection Authority.
Consent Requirements
Fully AddressedExplicit consent required. Other lawful bases include contract and legal obligation.
Data Subject Rights
Fully AddressedRights to access, rectification, erasure, and objection.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with appropriate safeguards.
Breach Notification
Fully AddressedMust notify the authority and affected individuals of data breaches.
DPO Requirements
Partially AddressedNot explicitly required for all organisations.
Children's Data
Partially AddressedGeneral provisions apply. No specific age threshold.
Penalties & Enforcement
Fully AddressedFines up to BHD 20,000. Criminal penalties including imprisonment.
Sector-Specific Rules
Fully AddressedCBB financial data regulations, health data rules.
Cookie/Tracking
Partially AddressedGeneral consent requirements apply.
AI & Automated Decisions
Not AddressedNo specific provisions on automated decisions.
Data Localisation
Partially AddressedSome sector-specific localisation requirements.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedPDPL applies to government processing with exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Bahrain's regulations.
Book a Consultation