BahrainPersonal Data Protection Law, cross-border transfer
Law No. 30 of 2018, Arts. 12-13
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Bahrain to a recipient outside Bahrain must confirm the destination is on the PDPA's published adequacy whitelist or has case-by-case PDPA authorisation, or must rely on one of Art. 13's listed exemptions such as the Data Subject's consent.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority's overview page describes Article 12 as prohibiting transfer without the data subject's specific consent unless a special authorization is issued, which differs from the text of Articles 12 and 13.
- As of
- Guidance link
- https://www.pdp.gov.bh/en/about-PDPA.html
- Guidance body
- Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority)
- Open questions
- Does a transfer to a country that "does not provide adequate level of protection" proceed on the data subject's consent under Article 13, paragraph 1, alone, or must it also be authorised under Article 12, given that the Authority's overview page describes Article 12 as requiring consent unless a special authorization is issued?
What it makes you log
Logging duty
Article 12 forbids transferring personal data outside the Kingdom except to a country on the record the Authority compiles and publishes in the Official Gazette or on its case-by-case authorisation, and Article 13 lists exceptions. The record of adequate countries is the Authority's own list, not one the controller keeps. The articles ask the controller for no log, and the transfer trigger concerns where the data go, not a scope clause.
- Kind
- None
- As of
What this law does
Art. 12 prohibits transfer of personal data outside Bahrain except to a country on a PDPA-published adequacy whitelist (published in the Official Gazette), or under a case-by-case PDPA authorisation based on an adequacy assessment considering the data's nature, origin and destination, and relevant international agreements.
Art. 13 lists exemptions allowing transfer to a non-adequate destination without going through Art. 12: data-subject consent, a public-register transfer, contract necessity, vital-interest protection, legal obligation or court or prosecution order, and legal-claim preparation. This is a prohibition-with-listed-exceptions structure, the strictest transfer posture across this batch.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .