Data Protection in Bahrain

Data Protection in Bahrain

The firm covers Bahrain matters in cooperation with a partner office in the Kingdom of Bahrain. That partner office is not a branch owned by the firm, and the firm does not itself hold a Bahrain law practice license; local licensing and representation are assessed for each matter in the Kingdom. Personal data in Bahrain is governed by the Personal Data Protection Law, Law No. 30 of 2018, issued on 19 July 2018 and in effect since 1 August 2019. Royal Decree No. 78 of 2019 designated the Ministry of Justice, Islamic Affairs and Waqf to assume the duties and powers of the Personal Data Protection Authority. With our partner office we place the entity under the law: whether it is a data controller, what it must notify or have authorised, and where data leaves the Kingdom.

Consent, information and individual rights

Without another legal basis, personal data may not be obtained or processed without the data subject's written and explicit consent, and specific consent is needed for particular processing such as transfer outside the Kingdom. Individuals must be given adequate information about who processes their data, why and how. They can find out whether an entity processes their data, ask for rectification, blocking or erasure, object to direct marketing such as behavioural targeting or text and email advertising, and complain in writing to the Authority.

Notification, authorisation and guardians

A controller must give the Authority prior notice of automated processing, with exceptions such as public registers, and notify changes. Some processing needs the Ministry's prior written authorisation, including linking personal data files of two or more controllers processed for different purposes, using biometric data to verify identity, and visual recording for surveillance. A controller may appoint a data protection guardian, and the Authority may require certain categories of controller to do so; the appointment must be notified within three working days.

Transfers outside the Kingdom

Transfer of personal data outside Bahrain is prohibited except to a country or territory on the Authority's list of those providing adequate protection, or in the exceptions the law lists, such as the data subject's consent or necessity for a contract. Ministerial Decision No. 42/2022 sets the detailed rules on transfers outside the Kingdom. To scope a Bahrain compliance file, see General Commercial & Corporate or contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has a branch in Cairo. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE and Qatar, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Which law governs personal data in Bahrain?

The Personal Data Protection Law, Law No. 30 of 2018, in effect since 1 August 2019. The Ministry of Justice, Islamic Affairs and Waqf assumes the duties of the Personal Data Protection Authority under Royal Decree No. 78 of 2019.

Do I have to notify the authority before processing data in Bahrain?

In general a controller must give the Authority prior notice of automated processing, with listed exceptions. Some processing, such as linking data files of different controllers, biometric identity verification and surveillance recording, needs prior written authorisation.

Who handles Bahrain data protection matters at the firm?

Bahrain matters are handled in cooperation with the firm's partner office in the Kingdom. The firm does not itself hold a Bahrain law practice license, and local licensing and representation are assessed for each matter.

Other markets

Corporate & Commercial Law in Bahrain · Data Protection in Egypt · Data Protection in Saudi Arabia · Data Protection in the UAE · Data Protection in Qatar · Data Protection in Oman