Bahrain's data protection law: what businesses must do
One of the Gulf's first data protection laws, in force since 2019, with administrative, criminal and civil consequences. Here is what it requires and how to comply in practice.
A GDPR-style law since 2019
Bahrain was one of the first Gulf states to adopt a general data protection law. The Personal Data Protection Law, Law No. 30 of 2018, came into force on 1 August 2019 and applies to the processing of personal data by individuals and organisations established in Bahrain, and to processing by means located in Bahrain. It is modelled on European principles: personal data must be processed fairly and lawfully, for specified purposes, kept accurate, retained no longer than necessary and protected by appropriate security measures.
The functions of the Personal Data Protection Authority have been exercised within the Ministry of Justice, Islamic Affairs and Waqf, which has issued a set of implementing resolutions on matters such as the data protection officer, notification, transfers outside Bahrain and the procedures for complaints. Companies operating in Bahrain should treat the law as fully in force and enforceable.
What a controller must do
Lawful basis
Consent, or another basis in the law such as performance of a contract, legal obligation, vital interests or legitimate interests. Sensitive data, including health, ethnicity, religion and political opinions, requires stronger conditions.
Notice
Tell individuals who is processing their data, why, for how long and to whom it may be disclosed, at the time of collection.
Notification and DPO
Notify the authority of certain processing before it begins, unless exempt, and appoint a data protection supervisor where required or chosen.
Security
Technical and organisational measures appropriate to the risk, including for processors acting on the controller's behalf.
Rights
Respond to requests for access, correction, blocking or erasure, and objections, including to direct marketing.
Transfers
Transfer data outside Bahrain only to countries with adequate protection, as listed by the authority, or under the conditions and permissions the law sets.
Administrative and criminal
The authority can investigate complaints and issue orders to stop or remedy violations, and impose administrative fines of up to BHD 20,000. Certain violations, such as processing sensitive data without the required conditions, transferring data abroad in breach of the law or failing to notify the authority, are also criminal offences punishable by fines and, in serious cases, imprisonment. Individuals can claim compensation for damage caused by unlawful processing.
The amounts are lower than under the GDPR or the ADGM regime, but the combination of administrative, criminal and civil exposure means that a breach in Bahrain is not only a regulatory matter. For regulated financial firms, the Central Bank of Bahrain's own rules on data, outsourcing and cybersecurity add a further layer.
Bahrain hosts a major cloud region and promotes itself as a data hub, with legislation allowing foreign governments' data to be hosted in Bahrain under their own jurisdiction. For private companies, the ordinary transfer rules still apply when data moves out of Bahrain to group systems abroad.
A programme for a Bahraini company
Map
List the personal data held: customers, employees, CPR and passport copies, payroll, CCTV, marketing lists; where it is stored; who receives it, including abroad.
Document
Privacy notice in Arabic and English, records of processing, retention schedule, processor clauses with service providers.
Notify and appoint
Check whether processing must be notified to the authority and whether to appoint a data protection supervisor.
Transfers
Identify transfers outside Bahrain and the legal basis for each: adequate country, consent or authority permission.
Respond
A procedure for individual requests and a plan for security incidents, including who decides on notification.
Train
Short training for staff handling customer and HR data, the most common source of incidents.
Three everyday risks
Three areas cause most problems in practice. Employee data: employers in Bahrain hold copies of CPR cards, passports, medical records for permits, salary and family details, and should restrict access, keep them only as long as legal obligations require, and never retain passports against employees' will. CCTV: cameras in offices and shops process personal data and require notice, a legitimate purpose, limited retention and controlled access. Marketing: individuals have the right to object to direct marketing, and electronic marketing to people who have not agreed is a frequent trigger for complaints.
Each is easy to get right with a short policy and a few controls, and each is the kind of issue a complainant can prove without difficulty.
A group with a Bahraini hub
A group runs its regional customer service centre from a Bahraini WLL, handling customers across the Gulf, with its CRM hosted in Europe and payroll processed by a provider in India. The Bahraini company is a controller for its employees' data and, depending on the contracts, a controller or processor for the customer data. Every record that flows to the European CRM and the Indian payroll provider is a transfer outside Bahrain.
To be compliant, the company needs a privacy notice covering both customers and staff, processor agreements with the CRM and payroll providers, a legal basis for each transfer under the Bahraini rules, a retention schedule and a breach plan. Because its customers are in Saudi Arabia, Qatar and the UAE as well, it also needs to consider those countries' data laws for the customer data it processes, which usually means building the programme to the strictest applicable standard and adding the Bahraini notification and transfer steps.
Banks, healthcare and telecoms
Regulated sectors face additional rules. Banks, insurers, payment and crypto-asset firms licensed by the Central Bank of Bahrain follow the CBB Rulebook on customer data, confidentiality, outsourcing, cloud and cybersecurity, which in several respects is stricter than the general law and requires approvals for some outsourcing and offshore processing. Healthcare providers handle data that is sensitive under the PDPL and subject to health regulators' requirements. Telecoms and internet services are subject to the telecoms regulator's rules on subscriber data.
A business in one of these sectors should treat the sector rules as the starting point and the PDPL as the floor, and should document how each requirement is met, because a sector regulator's inspection will ask.
Handling a data breach
A data breach, from a lost laptop to a compromised email account to a misdirected payroll file, needs a fast, organised response. Contain the incident, preserve evidence, assess what data and which individuals are affected, and decide whether the authority, affected individuals, a sector regulator or the police must be informed under the applicable rules. Record the incident and the decisions taken, whether or not it is notified.
Most breaches in small and mid-sized companies are caused by people, not sophisticated attacks: phishing, weak passwords, shared accounts and files sent to the wrong recipient. Multi-factor authentication, restricted access to HR and customer data and a short annual training session prevent most of them, and are the measures a regulator will ask about first.
One law among several
Bahrain's PDPL is one of several Gulf data laws a regional business may face. Saudi Arabia's PDPL is enforced by SDAIA with fines up to SAR 5 million and strict transfer rules; Qatar's PDPPL, the oldest in the GCC, has been actively enforced since 2024 with fines up to QAR 5 million; the UAE has a federal law awaiting its regulations alongside the DIFC and ADGM regimes, both actively enforced. Bahrain's law is comparable in substance, with lower fines but criminal exposure.
A group operating across these countries usually builds one programme to the strictest common standard, then adds each country's specific steps: notifications and transfer permissions in Bahrain, transfer assessments in Saudi Arabia and the DIFC, and Arabic-language notices everywhere. Treating Bahrain as the place where nothing is enforced is a mistake; the law is in force, the authority acts on complaints, and criminal provisions apply.
Processors and outsourcing
Most companies rely on outside providers that process personal data on their behalf: payroll bureaus, cloud and email services, CRM platforms, call centres, accountants. Under the PDPL the company remains responsible for that processing. Each provider should be bound by a written contract requiring it to act only on the company's instructions, keep the data confidential and secure, assist with individuals' requests and incidents, and return or delete the data at the end of the service. Where the provider processes data outside Bahrain, the transfer rules apply as well.
Three quick wins
If a company does nothing else this month, three steps reduce most of its exposure: publish a clear privacy notice on its website and in its contracts, switch on multi-factor authentication for email and core systems, and list every provider that holds its customer or staff data with a note of where that data is stored. Everything else in a compliance programme builds on those three.
Questions we get asked first
What is Bahrain's data protection law?
The Personal Data Protection Law, Law No. 30 of 2018, in force since 1 August 2019, modelled on European data protection principles.
Who enforces data protection in Bahrain?
The functions of the Personal Data Protection Authority have been exercised within the Ministry of Justice, Islamic Affairs and Waqf, which has issued implementing resolutions.
What are the penalties under Bahrain's PDPL?
Administrative fines of up to BHD 20,000, criminal penalties for certain violations including in serious cases imprisonment, and civil compensation for damage.
Can personal data be transferred outside Bahrain?
Yes, to countries with adequate protection as listed by the authority, or under conditions such as consent or authority permission.
Do I need to notify the authority before processing personal data?
Certain processing must be notified before it begins unless an exemption applies; check the implementing resolutions for your case.
Does the law cover employee data?
Yes. Employee records, including CPR and passport copies, medical data and payroll, are personal data, and health data is sensitive.
An established law, with real consequences
Bahrain's data protection law has been in force since 2019 and carries administrative, criminal and civil exposure. Map your data, document notices and processor contracts, put a legal basis behind every transfer abroad, and handle employee, CCTV and marketing data with care.
Processing personal data in Bahrain?
We map your data, prepare the notices and contracts and set up transfers and procedures under the Bahraini law.
Email us →Related reading
This article is general information, current as of 2026, and is not advice for any specific situation. Confirm current rules with the MOIC, the NBR or the relevant authority before acting.