⁦Bahrain PDPL⁩

⁦Bahrain⁩ پرائیویسی

حیثیت

⁦In force since 1 August 2019. The Ministry of Justice, Islamic Affairs and Waqf carries out the duties of the Personal Data Protection Authority (Decree No. 78 of 2019) and has issued ten implementing Orders.⁩✓ذرائع: ⁦pdp.gov.bh⁩, ⁦pdp.gov.bh⁩, ⁦pdp.gov.bh⁩

یہ کن پر لاگو ہوتا ہے

⁦Automated processing, and manual processing of data in a filing system (Art. 2(1)), by natural persons habitually resident or with a place of business in Bahrain, legal persons with a place of business in Bahrain, and anyone outside Bahrain who processes data using means located in Bahrain, unless only for transit (Art. 2(2)). Excluded: personal or family processing, and security bodies⁩' ⁦public security processing (Art. 2(4)).⁩⁦Art. 2 ↗⁩

سائز کی حدیں

⁦No size or turnover threshold. Extra duties depend on the processing: prior notice to the Authority, or its prior authorisation for sensitive, biometric, genetic or linked data and CCTV surveillance (Arts. 14 and 15).⁩

ریگولیٹر

⁦The Personal Data Protection Authority (Art. 27). Until it is funded and its board formed, the Ministry of Justice, Islamic Affairs and Waqf carries out its duties (Decree No. 78 of 2019).⁩✓ذرائع: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦Tell the Authority within 72 hours of discovering a breach, unless it would not affect data subjects⁩' ⁦rights, and explain any delay; tell the data subjects too, unless the data was unintelligible (for example encrypted), the high risk no longer exists or it would take disproportionate effort, in which case make a public notice (Order No. 43 of 2022, Art. 4).⁩⁦Order No. 43 of 2022, Art. 4 ↗⁩ · ذرائع: ⁦pdp.gov.bh⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦Free of charge: confirmation of processing with its details within 15 working days (Art. 18); objection to direct marketing or to damaging processing, and rectification, blocking or erasure, within 10 working days (Arts. 20, 21 and 23).⁩⁦Arts. 18, 20, 21, 23 ↗⁩ · ذرائع: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

ڈیٹا پروٹیکشن آفیسر

⁦Optional: a controller may appoint a Data Protection Guardian, who must be on the Authority⁩'⁦s register, and must tell the Authority within 3 working days; the Board may require some controllers to appoint one (Art. 10; Order No. 46 of 2022). With a Guardian, prior notice of processing is not needed (Art. 14(2)).⁩✓⁦Art. 10; Order No. 46 of 2022 ↗⁩ · ذرائع: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

مقامی نمائندہ

⁦Yes, for a legal person outside Bahrain that processes data using means in Bahrain: it must appoint a representative in Bahrain and tell the Authority at once (Art. 2(3)).⁩⁦Art. 2(3) ↗⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Transfers abroad are allowed only to countries on the Authority⁩'⁦s adequacy record (Order No. 42 of 2022 lists 83, including Saudi Arabia, the UAE, Oman, Kuwait, Pakistan, the UK, the US and the EU states), with the Authority⁩'⁦s case-by-case authorisation, or under exemptions such as consent, a contract with the data subject or legal claims (Arts. 12 and 13).⁩✓⁦Arts. 12–13; Order No. 42 of 2022 ↗⁩ · ذرائع: ⁦lloc.gov.bh⁩, ⁦pdp.gov.bh⁩

کوکیز اور رضامندی

⁦Without another legal basis (contract, legal obligation, vital interests, legitimate interests), processing needs consent that is written, explicit, clear and specific, and can be withdrawn (Arts. 4 and 24). Sensitive data has stricter conditions (Art. 5). Data subjects can object, free of charge, to direct marketing (Arts. 19 and 20). There is no cookie-specific rule.⁩

زیادہ سے زیادہ سزا

⁦Administrative fine up to BHD 20,000, plus a daily penalty up to BHD 1,000 (BHD 2,000 for a repeat within 3 years) (Art. 55). Criminal: up to 1 year in prison and/or a fine of BHD 1,000 to 20,000 for offences such as unlawful sensitive-data processing, unlawful transfers, or processing without notice or authorisation (Art. 58); fines are doubled for a legal person (Art. 59).⁩⁦Arts. 55, 58, 59 ↗⁩ · ذرائع: ⁦lloc.gov.bh⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦Give the Authority prior notice of automated processing, or appoint a registered Data Protection Guardian instead (Arts. 10 and 14).⁩
• ⁦Get the Authority⁩'⁦s prior written authorisation for sensitive, biometric or genetic data, linked databases and CCTV surveillance (Art. 15).⁩
• ⁦Report a breach to the Authority within 72 hours and tell affected data subjects (Order No. 43 of 2022, Art. 4).⁩
• ⁦Answer access requests within 15 working days and objection, rectification or erasure requests within 10 working days (Arts. 18, 20, 21 and 23).⁩
• ⁦Transfer data abroad only to listed countries, with authorisation or under an exemption (Arts. 12 and 13; Order No. 42 of 2022).⁩

حالیہ تبدیلیاں

⁦On 17 March 2022 the Ministry of Justice issued Order No. 42 of 2022 with the list of 83 countries with adequate protection; its other Orders include No. 43 (security measures and the 72-hour breach notice), No. 46 (Data Protection Guardians) and No. 48 (data subject rights).⁩✓

ذرائع

• بنیادی ذریعہ: ⁦https://www.lloc.gov.bh/FullEn/K3018.docx⁩
• دوسرا ذریعہ: ⁦https://www.pdp.gov.bh/en/executive-decisions.html⁩
• ریگولیٹر: ⁦The Personal Data Protection Authority (Art. 27). Until it is funded and its board formed, the Ministry of Justice, Islamic Affairs and Waqf carries out its duties (Decree No. 78 of 2019).⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.