Data protection & privacy law in Bahrain (2026)

Law No. 30 of 2018 (PDPL) was promulgated on 12 July 2018 and entered into force on 1 August 2019, applying to processing by any public or private entity based in Bahrain and to certain extraterritorial processing that uses means located in the Kingdom.

The PDPL created the Personal Data Protection Authority (PDPA); Royal Decree No. 78 of 2019 assigned the PDPA's functions to the Ministry of Justice, Islamic Affairs and Waqf, which operates the regulator through a dedicated unit and issues implementing Ministerial Orders.

Individuals have rights of access, rectification, objection, erasure of unlawfully processed data and withdrawal of consent; controllers must have a lawful basis (typically explicit written consent) and provide transparent information about purposes, recipients and processing.

Processing of sensitive data (health, religion, ethnicity, criminal records, biometrics) generally requires explicit consent or a specific legal basis under Article 5; certain automated processing operations require prior written authorisation from the PDPA.

Personal data may not be transferred outside Bahrain unless the destination provides adequate protection. Ministry of Justice Order No. 42 of 2022 sets out the 'white list' of 83 countries/territories deemed adequate; other transfers require appropriate safeguards or prior PDPA authorisation.

Controllers must notify the PDPA of qualifying personal data breaches within 72 hours; certain entities (e.g. those undertaking large-scale monitoring or processing of sensitive data) must appoint a Data Protection Guardian, the PDPL's equivalent of a GDPR DPO.

Violations may attract administrative fines up to BHD 20,000 (with daily penalties up to BHD 2,000) and criminal penalties including imprisonment up to one year and fines of BHD 1,000–20,000; fines are doubled for corporate offenders.