Bahrain. Comprehensive data protection. Law
Bahrain PDPLLaw No. (30) of 2018 with Respect to Personal Data Protection
In force
§1Summary
- Synopsis
Bahrain's general data protection law with GDPR-like principles, rights, notification/authorisation of certain processing, and transfer limits, backed by 2022 resolutions.
- Key themes
- Unique features
Authority publishes an adequacy list (83 jurisdictions); internal DPOs must be Bahrain residents; DPO mandatory for licensed financial institutions.
- SaaS relevance
Applies to processing in Bahrain and by non-resident controllers using means in Bahrain; SaaS clients will require processor terms.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority within 72h unless unlikely to affect rights
- DPO
- Conditional
- Cross-border transfers
- Adequacy list / Authority permission / consent and listed exceptions
- Maximum penalty
- BHD 20,000 and/or 1 year imprisonment; administrative fines
§3Dates
- Key dates
- Adopted
- In force
- Ministry acting as Authority under Decree 78/2019; 10 implementing ministerial resolutions 17 Mar 2022
§4Text and authority
- Text
- Authoritative text pdp.gov.bh
- Authority
- Personal Data Protection Authority (functions exercised by Ministry of Justice, Islamic Affairs and Endowments)
§5Where it applies
- Domestic law of
- Bahrain
§6Sources and verification
- Verification
High confidence.