Cybersecurity law & regulation in Bahrain (2026)

Legal framework

National Cyber Security Center (NCSC) established under Royal Decree No. 65 of 2020 with responsibilities defined by Royal Order No. 17 of 2025; supported by Law No. 60 of 2014 on IT Crimes, CNI Cybersecurity Controls, CBB Rulebook cybersecurity requirements for financial firms, and PDPL (Law No. 30 of 2018) breach-notification duties

Key points: cybersecurity in Bahrain

1. 01NCSC as central authority

   Royal Order No. 17 of 2025 (issued 10 July 2025) defines the NCSC's mandate to develop cybersecurity legislation, issue mandatory policies, publish specifications/frameworks, run the national incident response framework, and oversee protection of National Critical Sectors. It operates under the Supreme Defence Council.

   loc.gov asarlegal.com

2. 02Critical National Infrastructure controls

   The NCSC has issued CNI Cybersecurity Controls covering GEO (Gas/Electricity/Oil), Financial Services, ICT, Healthcare, Government Services, Critical Industry and Transportation, addressing cloud security, network security, third-party risk, data protection and incident reporting for designated CNI entities.

   ncsc.gov.bh ncsc.gov.bh

3. 03National Cyber Security Strategy 2025-2028

   Bahrain's second national cyber strategy (2025-2028) provides the current policy framework for protecting digital infrastructure, strengthening cyber leadership and building a trusted digital environment, building on the 2020-2024 strategy.

   ncsc.gov.bh ncsc.gov.bh

4. 04Financial-sector cyber rules (CBB)

   The Central Bank of Bahrain Rulebook (Volumes 1, 2, 5) sets mandatory cybersecurity requirements for licensed banks, insurers and other financial institutions, including risk-management controls, mandatory multi-factor authentication for remote/admin/customer/critical systems, vulnerability and patch management, and incident-reporting to the CBB.

   cbb.gov.bh cbb.gov.bh

5. 05Personal-data breach notification (72 hours)

   Under the Personal Data Protection Law (Law No. 30 of 2018) and Order No. 43 of 2022 (Article 4), controllers must notify Bahrain's Personal Data Protection Authority within 72 hours of becoming aware of a personal-data breach, and must inform affected data subjects where the breach is likely to pose a high risk to their rights.

   dlapiperdataprotection.com pdp.gov.bh resourcehub.bakermckenzie.com

6. 06Cybercrime criminal law

   Law No. 60 of 2014 on Information Technology Crimes criminalises illegal access, data/system interference, illegal interception, misuse of devices, IT-enabled fraud and content-related offences, with penalties up to 10 years' imprisonment and BD 300,000 fines for the most serious offences.

   bahrain.bh coe.int

7. 07CNI reporting mandatory, private-sector voluntary

   Critical National Infrastructure entities are required to report cyber incidents to the NCSC, while other private-sector organisations are not currently subject to a mandatory NCSC incident-reporting obligation and may report voluntarily via the NCSC's incident-reporting channel.

   asarlegal.com ncsc.gov.bh

Timeline of decisions

1. 17 Jul 2025Guidance
   CBB issues consolidated Cyber Security Requirements for financial licensees

   The Central Bank of Bahrain published updated Cyber Security Requirements in its Rulebook, consolidating board-level oversight, risk assessment, penetration testing and incident-reporting duties across banking, insurance and capital-market firms. It standardizes the cyber obligations applying to Bahrain's regulated financial sector.

   Central Bank of Bahrain Rulebook

2. 10 Jul 2025Law · official
   Royal Order No. 17 of 2025 defines and strengthens the National Cybersecurity Center's powers

   King Hamad issued Royal Order No. 17 of 2025 giving the National Cybersecurity Center (NCC) legislative, policy and technical authority, proposing cyber laws, issuing mandatory policies and standards, coordinating threat-sharing, and overseeing critical sectors under the Supreme Defence Council. It clarified the mandate left undefined when the NCC was created.

   Library of Congress (Global Legal Monitor)

3. 1 Jan 2025Law
   Penal Code amendments (Legislative Decree No. 3 of 2025) target electronic-device theft and cybercrime

   Amendments expand the Penal Code to cover theft and misuse of data-storing devices such as phones and laptops, complementing the 2014 IT Crimes Law and modernising criminal liability for online and electronic offences.

   Legal 500

4. 1 Jun 2023Guidance · official
   NCSC publishes National Risk Management Framework for Critical National Infrastructure

   The National Cyber Security Center issued a National Risk Management Framework and CNI cybersecurity controls covering seven critical sectors (energy, financial services, ICT, healthcare, government, critical industry, transport). It set the baseline technical controls operators of critical infrastructure must adopt.

   National Cyber Security Center

5. 1 Mar 2023Guidance · official
   CBB adds cybersecurity control guidelines to the Crypto-Asset Module

   The Central Bank of Bahrain amended its Crypto-Asset (CRA) Module to introduce cybersecurity control guidelines aimed at protecting clients' digital assets. It extended formal cyber obligations to crypto-asset service providers operating in Bahrain.

   Central Bank of Bahrain

6. 1 Jan 2020Law · official
   National Cyber Security Center established by Royal Decree No. 65 of 2020

   Royal Decree No. 65 of 2020 created the National Cybersecurity Center as the central national authority for cybersecurity, though it left detailed responsibilities to be defined later (by Royal Order No. 17 of 2025). It centralized national cyber governance for the first time.

   National Cyber Security Center

7. 1 Jan 2020Guidance · official
   Bahrain launches National Cyber Security Strategy 2020-2024

   Bahrain published a five-pillar national strategy spanning resilient cyber defenses, governance and standards, public awareness, partnerships, and workforce development. It established the policy roadmap and CNI-sector approach underpinning today's framework.

   National Cyber Security Center

8. 1 Dec 2019Guidance · official
   CBB introduces mandatory cyber security risk-management requirements for banks

   The Central Bank of Bahrain added cybersecurity chapters to its Operational Risk and Risk Management modules, mandating board accountability, periodic control assessments, biannual penetration testing, cyber insurance and staff training. It created the financial sector's binding cyber obligations.

   Central Bank of Bahrain

9. 1 Jan 2014Law · official
   Law No. 60 of 2014 on Information Technology Crimes

   Bahrain enacted its cybercrime law criminalizing illegal access, data and system interference, illegal interception, misuse of devices and content offences, with fines up to BHD 100,000. It remains the core criminal framework backing cybersecurity enforcement.

   ILO NATLEX

Sources

1. 1.ncsc.gov.bh/en/index.html
2. 2.ncsc.gov.bh/en/national-strategy/bahrain-national-cyber-security-strategy-2025-20
3. 3.ncsc.gov.bh/en/policies-controls/CNI-cybersecurity-controls.html
4. 4.ncsc.gov.bh/en/policies-controls/cybersecurity-risk-management.html
5. 5.loc.gov/item/global-legal-monitor/2025-12-08/kingdom-of-bahrain-new-royal-ord
6. 6.asarlegal.com/bahrain-formalizes-cybersecurity-centers-structure-and-powers/
7. 7.asarlegal.com/heightened-cyber-threats-legal-and-reporting-obligations-in-bahrain/
8. 8.cbb.gov.bh/wp-content/uploads/2021/07/Vol-4-RM-Cyber-Security.pdf
9. 9.cbb.gov.bh/wp-content/uploads/2024/01/Vol-2_OM_2024.pdf
10. 10.pdp.gov.bh/en/regulations.html
11. 11.dlapiperdataprotection.com/?t=breach-notification&c=BH
12. 12.resourcehub.bakermckenzie.com/bg-bg/resources/global-data-and-cyber-handbook/emea/bahrain/topics/se
13. 13.coe.int/en/web/octopus/country-wiki-ap/-/asset_publisher/CmDb7M4RGb4Z/content
14. 14.ncsc.gov.bh/en/national-strategy/bahrain-national-cyber-security-strategy-2020-20
15. 15.bahrain.bh/wps/portal/en/!ut/p/z1/tZPLVsIwEEB_pSxYtpmmtGFbfIEvFARtNpy0DRBtk9hG0b
16. 16.ncsc.gov.bh/en/terms-and-rights-corner/faqs.html