Bahrain's Personal Data Protection Law, Law No. 30 of 2018, has been in force since 1 August 2019. On 17 March 2022 the Personal Data Protection Authority published 10 resolutions that added a 72-hour breach rule, a whitelist of 83 countries for transfers and qualification rules for data protection officers. Key breaches carry criminal penalties of up to one year in prison.
The law and its regulator
Law No. 30 of 2018 on Personal Data Protection covers processing of personal data in the Kingdom of Bahrain. It came into force on 1 August 2019 and is enforced by the Personal Data Protection Authority (PDPA). Under the law the controller is often called the data manager. Article 14 requires the data manager to notify the Authority before processing. Article 5 sets rules for sensitive data and Article 8 governs processors, who must act under a binding written contract.
The 2022 resolutions
On 17 March 2022 the PDPA published 10 resolutions, including Nos. 42 to 48 of 2022, that fill in the detail. They are now the practical rulebook for most compliance work in Bahrain. The table lists the ones that most often affect day-to-day operations, from cloud hosting and incident response to cookie banners and staffing.
| Resolution | Subject | Key point |
|---|---|---|
| No. 42 of 2022 | Transfers | Whitelist of 83 countries; PDPA permit for others, including intra-group |
| No. 43 of 2022 | Breach notification | Notify the PDPA within 72 hours of discovery |
| No. 44 of 2022 | Prior approval | Biometrics, non-medical genetics, linking data sets, surveillance recording |
| No. 46 of 2022 | DPO qualifications | Rules for internal and external officers; PDPA decision within 30 days |
| No. 47 of 2022 | Fees | Fees linked to DPO matters |
| No. 48 of 2022 | Consent | Withdrawal at any time without cost; browsing-condition consent invalid |
Consent and cookies
Resolution No. 48 of 2022 lets individuals withdraw consent at any time without cost. It also says consent obtained as a condition of browsing a website is not valid. A banner that blocks the site until the visitor clicks accept is therefore a risk for Bahraini users. Offer a real choice for non-essential cookies and keep the site usable for visitors who decline. Explain in the policy how to change the choice later.
Breach notification
Under Resolution No. 43 of 2022, the data manager must notify the PDPA within 72 hours of discovering a breach, unless the breach is unlikely to threaten data subjects' rights. Affected data subjects should generally be told as well. Bahrain counts the 72 hours from discovery. Saudi Arabia, Qatar, Oman and ADGM also use a 72-hour window, so a regional team can run one process, but the regulator and filing route differ in each country.
Transfers abroad
Articles 12 and 13 of the PDPL restrict transfers outside Bahrain, and breaching them is a criminal offence. Resolution No. 42 of 2022 lists 83 whitelisted countries. Transfers to any other country need a PDPA permit, and that includes transfers within the same corporate group. Before moving data to a cloud region or a sister company abroad, check the destination against the whitelist. If it is not listed, apply for the permit before the transfer starts.
Restricted processing and DPOs
Under PDPL Article 15 and Resolution No. 44 of 2022, some processing needs prior approval from the PDPA: biometrics, non-medical genetic data, linking data sets and recording for surveillance. Fintech onboarding with face matching and CCTV in offices are common examples. Where a business appoints a data protection officer, the officer must meet the qualification rules in Resolution No. 46 of 2022, and the PDPA decides on approval within 30 days. Resolution No. 47 of 2022 sets the related fees.
Penalties and next steps
Article 58 provides criminal penalties: imprisonment of up to one year and a fine of BHD 1,000 to BHD 20,000, or either, for breaches of the sensitive data and transfer rules or unreasonable disclosure. Caps on administrative fines could not be verified for this guide.
Check transfers, restricted processing approvals and cookie consent first, as those carry the clearest risk. XDQ xAgents (https://xagents.xdqlabs.com) can test a Bahrain privacy policy for missing transfer and consent statements. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
When did Bahrain's data protection law take effect?
Law No. 30 of 2018 on Personal Data Protection came into force on 1 August 2019. The Personal Data Protection Authority published 10 implementing resolutions on 17 March 2022, covering transfers, breach notification, approvals, DPOs and consent.
Which countries can Bahraini companies transfer data to?
Resolution No. 42 of 2022 sets a whitelist of 83 countries. Transfers to other countries, including transfers within the same group of companies, need a permit from the PDPA. Breaching the transfer rules is a criminal offence.
What is the breach notification deadline in Bahrain?
Within 72 hours of discovering the breach, under Resolution No. 43 of 2022, unless it is unlikely to threaten data subjects' rights. Affected data subjects should generally also be notified.
Are cookie walls allowed in Bahrain?
Resolution No. 48 of 2022 says consent obtained as a condition of browsing a website is not valid, so forcing acceptance to use the site is risky. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Al Tamimi: Bahrain's Personal Data Protection Law comes into effect on 1 August 2019, Al Tamimi & Company, 2019
- Trowers & Hamlins: Bahrain enhances its data protection regime (2022 resolutions), Trowers & Hamlins, 2022
- Clyde & Co: Regulatory guidelines on the Qatar Personal Data Protection Law, Clyde & Co, 2021
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Taylor Wessing: New ADGM data protection law, key changes, Taylor Wessing, 2021
