Processes personal data, in Bahrain

Law No. 30 of 2018, Arts. 1, 5 · Read the law's page

• An app processing an individual's race, ethnic origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, or health or sexual status in Bahrain must obtain the Data Subject's consent unless the Art. 5 public-availability exception applies; biometric data is not part of this Sensitive Personal Data category, so it is governed instead by the Art. 15 prior-authorisation rule.

Law No. 30 of 2018, Arts. 12-13 · Read the law's page

• An app transferring the personal data of an individual in Bahrain to a recipient outside Bahrain must confirm the destination is on the PDPA's published adequacy whitelist or has case-by-case PDPA authorisation, or must rely on one of Art. 13's listed exemptions such as the Data Subject's consent.

Law No. 30 of 2018, Arts. 17-23 · Read the law's page

• An app that receives a data-subject request from an individual in Bahrain must respond within a fixed working-day deadline, ten or fifteen working days depending on the request type, rather than an open-ended reasonable-time standard.

Law No. 30 of 2018, Arts. 4-9 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Bahrain must obtain the Data Subject's consent or rely on a listed alternative lawful basis under the Personal Data Protection Law.

Law No. 30 of 2018, Arts. 55, 57-60 · Read the law's page

• An app processing the personal data of an individual in Bahrain without the required lawful basis, prior authorisation, or transfer safeguard risks both criminal penalties (imprisonment and fines up to BD 20,000) and administrative penalties (up to BD 20,000, plus a daily compliance penalty on repeat violation) from the Personal Data Protection Authority, and a data subject who suffers damage from unlawful processing may separately claim compensation directly from the app under Art. 57.