⁦Bahrain PDPL⁩

⁦Bahrain⁩ الخصوصية

الحالة

⁦In force since 1 August 2019. The Ministry of Justice, Islamic Affairs and Waqf carries out the duties of the Personal Data Protection Authority (Decree No. 78 of 2019) and has issued ten implementing Orders.⁩✓المصادر: ⁦pdp.gov.bh⁩, ⁦pdp.gov.bh⁩, ⁦pdp.gov.bh⁩

على من ينطبق

⁦Automated processing, and manual processing of data in a filing system (Art. 2(1)), by natural persons habitually resident or with a place of business in Bahrain, legal persons with a place of business in Bahrain, and anyone outside Bahrain who processes data using means located in Bahrain, unless only for transit (Art. 2(2)). Excluded: personal or family processing, and security bodies⁩' ⁦public security processing (Art. 2(4)).⁩⁦Art. 2 ↗⁩

حدود الحجم

⁦No size or turnover threshold. Extra duties depend on the processing: prior notice to the Authority, or its prior authorisation for sensitive, biometric, genetic or linked data and CCTV surveillance (Arts. 14 and 15).⁩

الجهة الرقابية

⁦The Personal Data Protection Authority (Art. 27). Until it is funded and its board formed, the Ministry of Justice, Islamic Affairs and Waqf carries out its duties (Decree No. 78 of 2019).⁩✓المصادر: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Tell the Authority within 72 hours of discovering a breach, unless it would not affect data subjects⁩' ⁦rights, and explain any delay; tell the data subjects too, unless the data was unintelligible (for example encrypted), the high risk no longer exists or it would take disproportionate effort, in which case make a public notice (Order No. 43 of 2022, Art. 4).⁩⁦Order No. 43 of 2022, Art. 4 ↗⁩ · المصادر: ⁦pdp.gov.bh⁩

مهلة الرد على طلبات البيانات الشخصية

⁦Free of charge: confirmation of processing with its details within 15 working days (Art. 18); objection to direct marketing or to damaging processing, and rectification, blocking or erasure, within 10 working days (Arts. 20, 21 and 23).⁩⁦Arts. 18, 20, 21, 23 ↗⁩ · المصادر: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

مسؤول حماية البيانات

⁦Optional: a controller may appoint a Data Protection Guardian, who must be on the Authority⁩'⁦s register, and must tell the Authority within 3 working days; the Board may require some controllers to appoint one (Art. 10; Order No. 46 of 2022). With a Guardian, prior notice of processing is not needed (Art. 14(2)).⁩✓⁦Art. 10; Order No. 46 of 2022 ↗⁩ · المصادر: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

الممثل المحلي

⁦Yes, for a legal person outside Bahrain that processes data using means in Bahrain: it must appoint a representative in Bahrain and tell the Authority at once (Art. 2(3)).⁩⁦Art. 2(3) ↗⁩

نقل البيانات إلى الخارج

⁦Transfers abroad are allowed only to countries on the Authority⁩'⁦s adequacy record (Order No. 42 of 2022 lists 83, including Saudi Arabia, the UAE, Oman, Kuwait, Pakistan, the UK, the US and the EU states), with the Authority⁩'⁦s case-by-case authorisation, or under exemptions such as consent, a contract with the data subject or legal claims (Arts. 12 and 13).⁩✓⁦Arts. 12–13; Order No. 42 of 2022 ↗⁩ · المصادر: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

ملفات تعريف الارتباط والموافقة

⁦Without another legal basis (contract, legal obligation, vital interests, legitimate interests), processing needs consent that is written, explicit, clear and specific, and can be withdrawn (Arts. 4 and 24). Sensitive data has stricter conditions (Art. 5). Data subjects can object, free of charge, to direct marketing (Arts. 19 and 20). There is no cookie-specific rule.⁩

أقصى عقوبة

⁦Administrative fine up to BHD 20,000, plus a daily penalty up to BHD 1,000 (BHD 2,000 for a repeat within 3 years) (Art. 55). Criminal: up to 1 year in prison and/or a fine of BHD 1,000 to 20,000 for offences such as unlawful sensitive-data processing, unlawful transfers, or processing without notice or authorisation (Art. 58); fines are doubled for a legal person (Art. 59).⁩⁦Arts. 55, 58, 59 ↗⁩ · المصادر: ⁦lloc.gov.bh⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Give the Authority prior notice of automated processing, or appoint a registered Data Protection Guardian instead (Arts. 10 and 14).⁩
• ⁦Get the Authority⁩'⁦s prior written authorisation for sensitive, biometric or genetic data, linked databases and CCTV surveillance (Art. 15).⁩
• ⁦Report a breach to the Authority within 72 hours and tell affected data subjects (Order No. 43 of 2022, Art. 4).⁩
• ⁦Answer access requests within 15 working days and objection, rectification or erasure requests within 10 working days (Arts. 18, 20, 21 and 23).⁩
• ⁦Transfer data abroad only to listed countries, with authorisation or under an exemption (Arts. 12 and 13; Order No. 42 of 2022).⁩

التغييرات الأخيرة

⁦On 17 March 2022 the Ministry of Justice issued Order No. 42 of 2022 with the list of 83 countries with adequate protection; its other Orders include No. 43 (security measures and the 72-hour breach notice), No. 46 (Data Protection Guardians) and No. 48 (data subject rights).⁩✓

المصادر

• المصدر الأساسي: ⁦https://www.lloc.gov.bh/FullEn/K3018.docx⁩
• المصدر الثاني: ⁦https://www.pdp.gov.bh/en/executive-decisions.html⁩
• الجهة الرقابية: ⁦The Personal Data Protection Authority (Art. 27). Until it is funded and its board formed, the Ministry of Justice, Islamic Affairs and Waqf carries out its duties (Decree No. 78 of 2019).⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.