Bahrain's Personal Data Protection Law: A Practical Checklist

Law No. 30 of 2018 applies to any business processing personal data in Bahrain. Here is how to comply.

The law

Bahrain's Personal Data Protection Law (Law No. 30 of 2018) came into force on 1 August 2019. It was one of the first comprehensive data-protection laws in the GCC.

Who it applies to

Individuals and organisations that process personal data in Bahrain, and those outside Bahrain that process data using means located in the Kingdom.

Core obligations

1. Lawful basis: process data with consent or another legal ground (contract, legal obligation, vital interests, legitimate interests).
2. Sensitive data: data about health, religion, ethnic origin and similar categories generally needs explicit consent.
3. Transparency: tell people what data you collect and why.
4. Security: apply technical and organisational measures to protect data.
5. Cross-border transfers: only to countries offering adequate protection, or with authorisation or another legal exception.
6. Rights: respond to requests for access, correction and objection.

Enforcement

The Personal Data Protection Authority supervises compliance and can impose administrative fines; some breaches are criminal offences.

Ask LexArab

LexArab can draft a Bahrain-compliant privacy notice or review your data-processing agreement. General information only.