Bahrain Personal Data Protection Law (PDPL) (Bahrain)

Framework Name

‍Bahrain Personal Data Protection Law (PDPL), Law No. 30 of 2018

Type

‍Mandatory

Region / Jurisdiction

‍Bahrain (extraterritorial reach to organizations outside Bahrain that process Bahrain residents' data using means available in Bahrain, unless the data is merely passing through)

Enforcing Body / Certifying Party

‍Personal Data Protection Authority (PDPA), whose functions are currently carried out by Bahrain's Ministry of Justice, Islamic Affairs and Waqf

Penalty / Consequence of Non-Compliance

‍Administrative fines reportedly up to BD 40,000 (roughly $106,000), and notably, unlike most privacy laws on this list, certain violations also carry criminal penalties, including imprisonment, for offenses such as unlawfully processing sensitive personal data or withholding information the Authority has requested

What It Is & Why It Matters

Bahrain's PDPL, in force since August 2019, was the first comprehensive data protection law in the Gulf Cooperation Council region, and it shares GDPR's overall architecture: lawful bases for processing, defined data subject rights, a 72-hour breach notification requirement, an independent supervisory authority, and restrictions on transferring personal data outside the country. Cross-border transfers are only permitted to countries on the Authority's approved list, currently around 83 countries, or under specific exceptions like consent. Processing sensitive personal data or biometric data for identification requires the Authority's prior written authorization before an organization can begin.

It matters because Bahrain moved first, and its approach has visibly shaped what followed elsewhere in the Gulf: all six GCC states now have some form of data protection law in force, and Bahrain's PDPL remains a common reference point for how they're structured. Its inclusion of real criminal penalties, not just civil fines, is also a meaningful departure from the EU and US models, which stick to administrative and civil enforcement, and worth flagging clearly since it changes the risk calculation for any company operating there.

Who Needs It

• You have a place of business in Bahrain and process personal data as part of operating there
• You are based outside Bahrain but process personal data of Bahrain residents using means available in Bahrain, such as a website or app targeting Bahraini users
• You need to transfer personal data out of Bahrain and must confirm the destination country is on the Authority's approved list
• You operate across the Gulf region and need to track Bahrain's PDPL alongside Saudi Arabia's PDPL (administered by SDAIA), the UAE's framework, and Qatar's PIPL separately, since each has its own specific requirements despite sharing a similar overall structure