Data Protection in Bahrain

Data Protection in Bahrain

The firm covers Bahrain matters in cooperation with a partner office in the Kingdom of Bahrain. That partner office is not a branch owned by the firm, and the firm does not itself hold a Bahrain law practice license; local licensing and representation are assessed for each matter in the Kingdom. Personal data in Bahrain is governed by the Personal Data Protection Law, Law No. 30 of 2018, issued on July 19, 2018 and in effect since August 1, 2019. Royal Decree No. 78 of 2019 designated the Ministry of Justice, Islamic Affairs and Waqf to assume the duties and powers of the Personal Data Protection Authority. With our partner office we place the entity under the law: whether it is a data controller, what it must notify or have authorized, and where data leaves the Kingdom.

Consent, information and individual rights

Without another legal basis, personal data may not be obtained or processed without the data subject's written and explicit consent, and specific consent is needed for particular processing such as transfer outside the Kingdom. Individuals must be given adequate information about who processes their data, why and how. They can find out whether an entity processes their data, ask for rectification, blocking or erasure, object to direct marketing such as behavioral targeting or text and email advertising, and complain in writing to the Authority.

Notification, authorization and guardians

A controller must give the Authority prior notice of automated processing, with exceptions such as public registers, and notify changes. Some processing needs the Ministry's prior written authorization, including linking personal data files of two or more controllers processed for different purposes, using biometric data to verify identity, and visual recording for surveillance. A controller may appoint a data protection guardian, and the Authority may require certain categories of controller to do so; the appointment must be notified within three working days.

Transfers outside the Kingdom

Transfer of personal data outside Bahrain is prohibited except to a country or territory on the Authority's list of those providing adequate protection, or in the exceptions the law lists, such as the data subject's consent or necessity for a contract. Ministerial Decision No. 42/2022 sets the detailed rules on transfers outside the Kingdom. To scope a Bahrain compliance file, see General Commercial & Corporate or contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has its own Cairo office. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE, Qatar, Bahrain and Oman, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Which law governs personal data in Bahrain?

The Personal Data Protection Law, Law No. 30 of 2018, in effect since August 1, 2019. The Ministry of Justice, Islamic Affairs and Waqf assumes the duties of the Personal Data Protection Authority under Royal Decree No. 78 of 2019.

Do I have to notify the authority before processing data in Bahrain?

In general a controller must give the Authority prior notice of automated processing, with listed exceptions. Some processing, such as linking data files of different controllers, biometric identity verification and surveillance recording, needs prior written authorization.

Who handles Bahrain data protection matters at the firm?

Bahrain matters are handled in cooperation with the firm's partner office in the Kingdom. The firm does not itself hold a Bahrain law practice license, and local licensing and representation are assessed for each matter.

Other markets

Corporate & Commercial Law in BahrainData Protection in EgyptData Protection in Saudi ArabiaData Protection in the UAEData Protection in QatarData Protection in Oman