Data protection & privacy law in Bahrain (2026)

Legal framework

Personal Data Protection Law (PDPL) — Law No. 30 of 2018, in force since 1 August 2019; supervised by the Personal Data Protection Authority (PDPA), whose functions are entrusted to the Ministry of Justice, Islamic Affairs and Waqf under Royal Decree No. 78 of 2019.

Key points: data & privacy in Bahrain

1. 01Primary law and effective date

   Law No. 30 of 2018 (PDPL) was promulgated on 12 July 2018 and entered into force on 1 August 2019, applying to processing by any public or private entity based in Bahrain and to certain extraterritorial processing that uses means located in the Kingdom.

   bahrain.bh pdp.gov.bh

2. 02Supervisory authority

   The PDPL created the Personal Data Protection Authority (PDPA); Royal Decree No. 78 of 2019 assigned the PDPA's functions to the Ministry of Justice, Islamic Affairs and Waqf, which operates the regulator through a dedicated unit and issues implementing Ministerial Orders.

   pdp.gov.bh tamimi.com

3. 03Data subject rights and lawful basis

   Individuals have rights of access, rectification, objection, erasure of unlawfully processed data and withdrawal of consent; controllers must have a lawful basis (typically explicit written consent) and provide transparent information about purposes, recipients and processing.

   dlapiperdataprotection.com pdp.gov.bh

4. 04Sensitive data and prior authorisation

   Processing of sensitive data (health, religion, ethnicity, criminal records, biometrics) generally requires explicit consent or a specific legal basis under Article 5; certain automated processing operations require prior written authorisation from the PDPA.

   clydeco.com dlapiperdataprotection.com

5. 05Cross-border transfers

   Personal data may not be transferred outside Bahrain unless the destination provides adequate protection. Ministry of Justice Order No. 42 of 2022 sets out the 'white list' of 83 countries/territories deemed adequate; other transfers require appropriate safeguards or prior PDPA authorisation.

   pdp.gov.bh clydeco.com

6. 06Breach notification and Data Protection Guardian

   Controllers must notify the PDPA of qualifying personal data breaches within 72 hours; certain entities (e.g. those undertaking large-scale monitoring or processing of sensitive data) must appoint a Data Protection Guardian, the PDPL's equivalent of a GDPR DPO.

   dlapiperdataprotection.com pdp.gov.bh

7. 07Sanctions

   Violations may attract administrative fines up to BHD 20,000 (with daily penalties up to BHD 2,000) and criminal penalties including imprisonment up to one year and fines of BHD 1,000–20,000; fines are doubled for corporate offenders.

   dlapiperdataprotection.com akingump.com

Timeline of decisions

1. 24 Mar 2025Guidance
   Central Bank of Bahrain orders financial firms to appoint Data Protection Guardians

   The CBB directed all licensees acting as data controllers to appoint a Data Protection Guardian (DPO) and notify the PDPA, embedding PDPL compliance into financial-sector supervision.

   Lex Mundi (citing CBB directive)

2. 17 Mar 2022Guidance · official
   Personal Data Protection Authority operationalized with 10 supplementing resolutions

   Bahrain stood up the Personal Data Protection Authority (PDPA) and issued ten ministerial resolutions implementing the PDPL, covering security measures, breach handling and cross-border transfers. It marked the start of active enforcement of the data-protection and data-security regime.

   Personal Data Protection Authority

3. 17 Mar 2022Guidance
   Resolution No. 46 of 2022 defines Data Protection Guardian (DPO) rules

   Set out when and how controllers must appoint internal or external Data Protection Guardians, with notification to the PDPA within three working days, later relied on by the CBB's 2025 financial-sector directive.

   Lexis Middle East

4. 17 Mar 2022Guidance · official
   Order No. 42 of 2022 sets cross-border transfer rules and adequacy whitelist

   Established the conditions for transferring personal data outside Bahrain and the Authority's 'adequate protection' country list, defining the legal basis for international data flows.

   Personal Data Protection Authority (PDPA)

5. 17 Mar 2022Guidance · official
   PDPA issues ~10 ministerial executive orders operationalizing the PDPL

   The Ministry of Justice, acting as the Personal Data Protection Authority, issued the package of executive resolutions (Orders 42-46 of 2022) that turned the 2018 law into an enforceable, operational regime covering transfers, security, notifications and DPOs.

   Personal Data Protection Authority (PDPA)

6. 1 May 2021Guidance
   PDPA opens public consultation on draft executive decisions

   The Authority published draft executive resolutions on notifications, sensitive-data processing and international transfers for stakeholder feedback, the consultation phase that shaped the 2022 implementing rules.

   Trowers & Hamlins

7. 1 Aug 2019Law · official
   Personal Data Protection Law (Law No. 30 of 2018) enters into force

   After a one-year transition, Bahrain's PDPL became effective, making it the first GCC state with a comprehensive, generally-applicable data protection statute and creating enforceable rights for data subjects.

   Personal Data Protection Authority (PDPA)

8. 1 Jan 2019Decision · official
   Royal Decree No. 78 of 2019 designates the Ministry of Justice as the data-protection authority

   Pending a standalone regulator, the decree assigned the Ministry of Justice, Islamic Affairs and Waqf to perform the PDPA's functions, establishing the supervisory body that enforces the law.

   Government of Bahrain

9. 12 Jul 2018Law · official
   King promulgates Law No. 30 of 2018 on Personal Data Protection

   King Hamad bin Isa Al Khalifa enacted Bahrain's foundational data-protection statute, setting out lawful-processing principles, data-subject rights, transfer restrictions and the framework for a supervisory authority.

   Ministry of Legislative Affairs (Bahrain official gazette)

Sources

1. 1.bahrain.bh/wps/wcm/connect/9956c467-1dd4-4bc6-a117-f88ca8f6f473/LAW+NO.+(30)+OF+
2. 2.pdp.gov.bh/en/index.html
3. 3.pdp.gov.bh/en/about-PDPA.html
4. 4.pdp.gov.bh/assets/pdf/executive-decisions/eng/trans-order-countries-and-territor
5. 5.dlapiperdataprotection.com/index.html?t=law&c=BH
6. 6.tamimi.com/news/ministry-of-justice-islamic-affairs-and-awqaf-entrusted-with-the
7. 7.clydeco.com/en/insights/2022/04/bahrain-issues-new-privacy-guidelines
8. 8.akingump.com/en/insights/blogs/ag-data-dive/bahrain-s-new-data-protection-law-now-