BahrainPersonal Data Protection Law, sensitive personal data
Law No. 30 of 2018, Arts. 1, 5
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app processing an individual's race, ethnic origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, or health or sexual status in Bahrain must obtain the Data Subject's consent unless the Art. 5 public-availability exception applies; biometric data is not part of this Sensitive Personal Data category, so it is governed instead by the Art. 15 prior-authorisation rule.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority's Executive Decisions/Orders page lists an order on the rules and procedures for processing sensitive personal data, issued under the last paragraph of Article 5; it is an implementing instrument, not guidance.
- As of
- Open questions
- Does "any information in relation to his health or sexual status" in the Article 1 definition of Sensitive Personal Data reach a face or voice template from which a health condition could be inferred?
What it makes you log
Logging duty
Article 1 defines the terms and Article 5 prohibits processing sensitive personal data without consent, subject to listed exceptions, some needing the Authority's prior approval. Neither asks the controller for a log or record, and neither carries a territorial clause.
- Kind
- None
- As of
What this law does
Art. 1's Sensitive Personal Data definition covers race, ethnical origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, and health or sexual status. Biometric data is absent from this list, the same gap found in Qatar's PDPPL; it is instead regulated separately under Art. 15 (see the biometric privacy instrument).
Art. 5(3) exempts data the Data Subject has made publicly available from the Sensitive Personal Data consent rule, but because biometric data is not itself Sensitive Personal Data, this exemption does not textually reach Art. 15's separate biometric prior-authorisation gate.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .