Bahrain PDPL

Law No. (30) of 2018 with Respect to Personal Data Protection Law

Sourced · 6/14 facts confirmed by two sources. Last verified 3 November 2026

Next full re-check due: May 2027. Regulator news is checked monthly; changes are logged in the change log.

Early-stage page. Fewer than half of the facts below have been cross-checked against a second source yet. Use it as a starting point and check the official text before relying on it.

Cite this page: GlanceDesk Jurisdiction, “Bahrain PDPL (Bahrain)”, glancedeskjurisdiction.com/laws/bh-pdpl, last verified 3 November 2026.

Bahrain Privacy

Status: In force since 1 August 2019. The Ministry of Justice, Islamic Affairs and Waqf carries out the duties of the Personal Data Protection Authority (Decree No. 78 of 2019) and has issued ten implementing Orders.✓Sources: pdp.gov.bh, pdp.gov.bh, pdp.gov.bh
Who it applies to: Automated processing, and manual processing of data in a filing system (Art. 2(1)), by natural persons habitually resident or with a place of business in Bahrain, legal persons with a place of business in Bahrain, and anyone outside Bahrain who processes data using means located in Bahrain, unless only for transit (Art. 2(2)). Excluded: personal or family processing, and security bodies' public security processing (Art. 2(4)).Art. 2 ↗
Size thresholds: No size or turnover threshold. Extra duties depend on the processing: prior notice to the Authority, or its prior authorisation for sensitive, biometric, genetic or linked data and CCTV surveillance (Arts. 14 and 15).
Regulator: The Personal Data Protection Authority (Art. 27). Until it is funded and its board formed, the Ministry of Justice, Islamic Affairs and Waqf carries out its duties (Decree No. 78 of 2019).✓Sources: lloc.gov.bh, pdp.gov.bh
Breach or incident reporting: Tell the Authority within 72 hours of discovering a breach, unless it would not affect data subjects' rights, and explain any delay; tell the data subjects too, unless the data was unintelligible (for example encrypted), the high risk no longer exists or it would take disproportionate effort, in which case make a public notice (Order No. 43 of 2022, Art. 4).Order No. 43 of 2022, Art. 4 ↗ · Sources: pdp.gov.bh
Deadline to answer personal data requests: Free of charge: confirmation of processing with its details within 15 working days (Art. 18); objection to direct marketing or to damaging processing, and rectification, blocking or erasure, within 10 working days (Arts. 20, 21 and 23).Arts. 18, 20, 21, 23 ↗ · Sources: lloc.gov.bh, pdp.gov.bh
Data protection officer: Optional: a controller may appoint a Data Protection Guardian, who must be on the Authority's register, and must tell the Authority within 3 working days; the Board may require some controllers to appoint one (Art. 10; Order No. 46 of 2022). With a Guardian, prior notice of processing is not needed (Art. 14(2)).✓Art. 10; Order No. 46 of 2022 ↗ · Sources: lloc.gov.bh, pdp.gov.bh
Local representative: Yes, for a legal person outside Bahrain that processes data using means in Bahrain: it must appoint a representative in Bahrain and tell the Authority at once (Art. 2(3)).Art. 2(3) ↗
Sending data abroad: Transfers abroad are allowed only to countries on the Authority's adequacy record (Order No. 42 of 2022 lists 83, including Saudi Arabia, the UAE, Oman, Kuwait, Pakistan, the UK, the US and the EU states), with the Authority's case-by-case authorisation, or under exemptions such as consent, a contract with the data subject or legal claims (Arts. 12 and 13).✓Arts. 12–13; Order No. 42 of 2022 ↗ · Sources: lloc.gov.bh, pdp.gov.bh
Cookies and consent: Without another legal basis (contract, legal obligation, vital interests, legitimate interests), processing needs consent that is written, explicit, clear and specific, and can be withdrawn (Arts. 4 and 24). Sensitive data has stricter conditions (Art. 5). Data subjects can object, free of charge, to direct marketing (Arts. 19 and 20). There is no cookie-specific rule.
Maximum penalty: Administrative fine up to BHD 20,000, plus a daily penalty up to BHD 1,000 (BHD 2,000 for a repeat within 3 years) (Art. 55). Criminal: up to 1 year in prison and/or a fine of BHD 1,000 to 20,000 for offences such as unlawful sensitive-data processing, unlawful transfers, or processing without notice or authorisation (Art. 58); fines are doubled for a legal person (Art. 59).Arts. 55, 58, 59 ↗ · Sources: lloc.gov.bh

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

Give the Authority prior notice of automated processing, or appoint a registered Data Protection Guardian instead (Arts. 10 and 14).
Get the Authority's prior written authorisation for sensitive, biometric or genetic data, linked databases and CCTV surveillance (Art. 15).
Report a breach to the Authority within 72 hours and tell affected data subjects (Order No. 43 of 2022, Art. 4).
Answer access requests within 15 working days and objection, rectification or erasure requests within 10 working days (Arts. 18, 20, 21 and 23).
Transfer data abroad only to listed countries, with authorisation or under an exemption (Arts. 12 and 13; Order No. 42 of 2022).

Recent changes

On 17 March 2022 the Ministry of Justice issued Order No. 42 of 2022 with the list of 83 countries with adequate protection; its other Orders include No. 43 (security measures and the 72-hour breach notice), No. 46 (Data Protection Guardians) and No. 48 (data subject rights).✓

Sources

Sources used for the independent check (8)

= confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.