BahrainPersonal Data Protection Law, biometric data prior authorisation
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app must obtain the Personal Data Protection Authority's prior written authorisation before automatically processing biometric data to verify an individual's identity in Bahrain, and before processing a visual recording used for surveillance purposes; consent alone is not a sufficient basis for either activity.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority's Executive Decisions/Orders page lists an order on the rules and procedures for submitting prior authorization requests; it is an implementing instrument, not guidance.
- As of
- Guidance link
- https://www.pdp.gov.bh/en/about-PDPA.html
- Guidance body
- Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority)
- Open questions
- Does Article 15 reach automatic processing of biometric data for a purpose other than verifying identity, such as search or profiling, given that item 2 covers only "Automatic processing of biometric data necessary for the verification" of an individual's identity?
What it makes you log
Logging duty
Article 15 bars the listed operations, including automatic biometric processing for identity verification and surveillance by visual recording, without the Authority's prior written authorisation. The request for authorisation is a filing; the article asks the controller for no log or record. The Authority's Notifications and Authorisations Register is the Authority's own record under Article 16, which the row does not cite. The article carries no territorial clause.
- Kind
- None
- As of
What this law does
Art. 15 prohibits, without the PDPA's prior written authorisation, five listed operations including automatic processing of biometric data necessary for the verification of an individual's identity (Art. 15(2)), and processing by means of visual recording used for surveillance purposes (Art. 15(5)).
This sits in its own category distinct from Sensitive Personal Data (Art. 5) and genetic data (Art. 15(3)), gated by a heavier control than mere consent: ex ante regulatory authorisation before processing may begin at all. No modality-specific (voice or face) language was found.
Art. 15(2)'s framing is keyed to a verification use case; it is a genuine, unresolved textual question whether a biometric identifier created for a non-verification purpose (profiling, search, watchlist matching) falls within Art. 15(2) at all, or falls entirely outside both the Sensitive Personal Data consent rule and the Art. 15 prior-authorisation rule. Art. 15(5) independently reaches a faceprint derived from CCTV or similar recorded video used for surveillance. No retention or destruction duty specific to biometric data was found.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .