🇧🇭Personal Data Protection Law, 2018
A law built around written consent and authority oversight
Law No. 30 of 2018, Bahrain's Personal Data Protection Law, came into force on 1 August 2019. It was one of the first comprehensive data protection statutes in the Gulf, and it sets a relatively complete framework: lawful processing conditions, heightened rules for sensitive data, a transfer regime, a notification and authorisation system, a full catalogue of data subject rights, and an enforcement structure carrying both civil and criminal liability.
The Act is built around one central idea: personal data may not be obtained or processed without a legal basis, and the default legal basis is the data subject's written and explicit consent. Consent. Specific consent is required for certain processing — most importantly the transfer of personal data outside the Kingdom. The PDPL treats consent as the foundation and the other lawful-processing conditions as defined alternatives, not as a broad balancing discretion. That structure is the law's clearest feature and its most common source of compliance failure, because organisations used to a legitimate-interest framework often assume more room than the Act allows.
Who the Act covers — and where it reaches
The PDPL applies to the processing of personal data by automated or manual means where the data forms part of a filing system. It covers any natural or legal person — including public entities — residing or conducting business in Bahrain. Critically, it also reaches organisations located outside Bahrain where they process personal data using means located within the Kingdom. There is no revenue threshold or small-business carve-out: if you process personal data of individuals in Bahrain within scope, you are covered.
The Act uses a defined set of roles. The data controller (the "data manager" in some translations) is the person who, alone or jointly, determines the purposes and means of processing. The data processor processes personal data for the controller's benefit and on the controller's behalf. The data subject is the individual whose data is processed. Bahrain adds a role that has no GDPR equivalent: the Data Protection Guardian under Article 10, a person appointed in connection with the Authority. Understanding which role you occupy matters, because the Act assigns obligations and liability by role.
The consent requirement — written and explicit
Under the PDPL, without a legal basis personal data may not be obtained or processed without the data subject's written and explicit consent. This is a higher formality than a passive opt-in. General conditions for legitimate processing are set out in Article 4, and the Act identifies the limited circumstances in which processing may proceed on a basis other than consent. Where consent is the basis, it must be explicit and recorded — it cannot be inferred from silence or pre-ticked boxes.
Specific consent is required for particular processing. The clearest example is the transfer of personal data outside the Kingdom, which the Act prohibits without the data subject's specific consent unless an adequacy or authorisation route applies. Direct marketing carries its own consent and objection architecture: the data subject must be notified of the right to object to direct marketing (Article 19) and has a standing right to object to processing for direct marketing purposes (Article 20). Treating a single blanket consent as covering transfers, marketing and sensitive processing alike is a common and serious error.
Sensitive personal data — a higher bar with criminal exposure
The PDPL defines sensitive personal data broadly: information revealing, directly or indirectly, an individual's race, ethnic origin, political or philosophical opinions, religious beliefs, trade union affiliation, personal criminal record, or any information relating to health or sexual status. Article 5 sets specific conditions for processing sensitive personal data that go beyond the general conditions in Article 4.
What makes Bahrain's treatment of sensitive data distinctive is the enforcement consequence. The unlawful processing of sensitive personal data is among the violations that carry criminal liability under Article 58 — not merely an administrative finding. An organisation that processes health data, criminal record information or data revealing political or religious views without satisfying the Article 5 conditions is exposed to fines and potential imprisonment, not just a corrective order. Sensitive data handling should therefore be treated as a controlled activity with documented legal basis, not a routine processing decision.
Security, confidentiality and the Data Protection Guardian
The Act imposes obligations on the security of processing (Article 8) and the confidentiality of processing (Article 9). Controllers must implement measures appropriate to protect personal data against unauthorised access, alteration, disclosure or loss, and those bound by the processing must maintain confidentiality. These are operative obligations, not aspirations — a controller that has valid consent but inadequate security is still in breach.
Article 10 establishes the Data Protection Guardian, a person appointed by the Authority. This is a structural feature unique to Bahrain's framework among the jurisdictions covered here. Organisations should track the Authority's resolutions on how the Guardian role operates in practice, who must engage with it, and what its appointment means for their internal accountability structure, because the statute leaves the operating detail to be filled in by the Authority's resolutions.
Registers, notification and prior authorisation
The PDPL operates a notification and authorisation system that sits at the centre of compliance. Article 11 addresses data registers, and Article 16 establishes the Register maintained in connection with the Authority. Article 14 requires notification to the Authority for certain processing. Most significantly, Article 15 imposes a prior authorisation requirement: certain processing operations may not begin until the Authority has authorised them.
Prior authorisation is the feature that most distinguishes Bahrain from a pure consent-and-notify regime. Processing that engages the prior authorisation requirement — which includes the kinds of higher-risk processing the Authority designates, such as automated evaluation of individuals — cannot be cured after the fact by good documentation. The authorisation process itself has defined timelines: the Authority may instruct a controller to complete a deficient request within a set period and is to rule on an authorisation request within a defined window of submission. Organisations should map which of their processing activities require notification, which require prior authorisation, and build the lead time for authorisation into their project planning.
International transfers — adequacy, specific consent, or authorisation
Article 12 prohibits the transfer of personal data outside the Kingdom unless the destination country or territory provides an adequate level of protection. The Authority maintains the whitelist of countries and territories regarded as adequate. Where the destination is not on the whitelist, the transfer is prohibited without the data subject's specific consent, unless a special authorisation is issued. Article 13 sets out the exemptions to the transfer prohibition — narrow, defined circumstances rather than a general flexibility.
The practical sequence is: confirm whether the destination is on the Authority's whitelist; if not, obtain the data subject's specific consent to the transfer or secure a special authorisation; and only rely on an Article 13 exemption where the specific circumstances genuinely apply. The unauthorised transfer of personal data outside Bahrain is among the violations attracting criminal liability under Article 58, so transfer governance is not just a contractual exercise — it is an area of direct personal and corporate criminal exposure.
A multinational with a Bahrain branch consolidated its customer records onto a cloud platform hosted outside the Kingdom, in a country not on the Authority's whitelist. Its global privacy programme was mature: notices published, processor agreements signed, security controls certified. What it had not done was obtain the data subjects' specific consent to the cross-border transfer or secure a special authorisation. Under Article 12, the transfer was prohibited from the moment it began — adequacy, specific consent, or authorisation are the only routes, and none was in place. Because the unauthorised transfer of personal data outside Bahrain falls within the criminal provisions of Article 58, the exposure was not limited to an administrative fine. The organisation's mature global documentation was evidence that it understood its obligations, not a substitute for the Bahrain-specific authorisation route. The remediation required suspending the transfer, repapering consent, and applying for authorisation before processing could lawfully resume.
Data subject rights
The PDPL gives data subjects a full catalogue of rights. Controllers must provide information to the data subject (Article 17). Data subjects can request to be notified upon the processing of their personal data (Article 18). They must be told of the right to object to direct marketing (Article 19) and can exercise that objection (Article 20). They can object to processing that causes material or moral damage to themselves or others (Article 21). They have a specific right to object to decisions based on automated processing (Article 22). They can request rectification, blocking and erasure of data (Article 23). Consent is governed by Article 24, and complaints may be lodged with the Authority under Article 25, with the procedural mechanics for requests, objections and complaints set out in Article 26.
The right to object to automated decision-making (Article 22) deserves particular attention because it connects to the prior authorisation regime: automated evaluation of individuals is both a processing activity the data subject can object to and one that engages the Authority's authorisation requirements. An organisation deploying automated decisioning in Bahrain has to satisfy both the authorisation gate and the objection right.
The Authority, accountability and enforcement
Part II of the Act establishes the Personal Data Protection Authority (Article 27) under the oversight of the Minister (Article 28), with defined duties and powers (Article 30), inspection powers (Article 36), and a specific channel for notification to the Central Bank of Bahrain (Article 38) — a sector hook relevant to financial institutions. The Authority is governed by a Board and a Chief Executive.
Part III sets out accountability of the data controller and data guardian. The Authority can conduct investigations (Article 47) under defined procedures (Article 48), request information from third parties (Article 49), examine witnesses (Article 51), and take permitted measures where it finds evidence of violation (Article 55), including in cases of urgency (Article 56). Enforcement runs on three tracks: civil liability and compensation (Article 57), criminal liability and penalties (Article 58), liability of the legal person (Article 59), and conciliation (Article 60). The criminal track is the feature that most sharpens the stakes — serious violations such as unlawful sensitive-data processing, unauthorised cross-border transfer, and failure to notify as required can attract fines and imprisonment, alongside administrative penalties.
Article 2 — Scope: applies to automated and manual processing within a filing system; covers persons in Bahrain and those outside who process using means in the Kingdom.
Article 4 — General conditions for legitimate processing: written and explicit consent is the default legal basis; other conditions are defined alternatives.
Article 5 — Sensitive personal data: specific conditions apply; unlawful processing carries criminal liability under Article 58.
Articles 8–9 — Security and confidentiality of processing: operative obligations to protect personal data.
Article 10 — Data Protection Guardian: a person appointed by the Authority; a structural feature distinctive to Bahrain.
Articles 11, 16 — Registers: data registers and the Authority's Register.
Article 12 — Transfer outside the Kingdom: prohibited unless the destination is adequate (whitelist), the data subject gives specific consent, or a special authorisation is issued.
Article 13 — Exemptions to the transfer prohibition: narrow and defined.
Articles 14–15 — Notification and prior authorisation: certain processing must be notified to the Authority; certain processing requires prior authorisation before it begins.
Articles 17–26 — Data subject rights: information, notification of processing, objection to direct marketing, objection to damaging processing, objection to automated decisions, rectification/blocking/erasure, consent, and complaints.
Articles 57–60 — Enforcement: civil compensation, criminal penalties, liability of the legal person, and conciliation.
The Bahrain PDPL is not a documentation exercise. It is a consent-first framework wrapped in a notification-and-authorisation system, backed by criminal liability for the most serious breaches. Your checklists tell you what to do. This law tells you why: because written and explicit consent is the default you must be able to prove, sensitive data demands a heightened legal basis with criminal exposure if you get it wrong, transfers outside the Kingdom need adequacy, specific consent or authorisation, certain processing cannot begin until the Authority authorises it, and the data subject can object to your automated decisions. The organisations that map their notification and authorisation obligations before they process — not after an inspection — are the ones that stay on the right side of both the administrative and the criminal track.