Law / Bahrain

Personal Data Protection Law, data subject rights

Law No. 30 of 2018, Arts. 17-23

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 August 2019.

A data subject rights rule binding public and private bodies.

As of 29 August 2026.

What it requires

  • An app that receives a data-subject request from an individual in Bahrain must respond within a fixed working-day deadline, ten or fifteen working days depending on the request type, rather than an open-ended reasonable-time standard.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section Five (Arts. 17-23) sets Bahrain's data-subject rights, each with its own working-day deadline. The Data Controller must notify a Data Subject who requests confirmation of processing within 15 working days (Art. 18(1)). It must halt or decline to begin direct-marketing processing and notify the Data Subject of its decision within 10 working days of a marketing objection (Art. 20(1)-(2)).

It must halt or decline to begin processing that causes material or moral damage within 10 working days of an objection on that ground (Art. 21(1)). It must respond to a rectification, blocking, or erasure request within 10 working days (Art. 23(1)).

Art. 17 separately requires the Data Controller to brief the Data Subject on the purposes of processing at the time data is obtained, Art. 19 requires notice of the right to object to direct marketing, and Art. 22 gives a Data Subject a right against a decision based solely on automated processing. Art. 32 (Conflict of Interest) governs PDPA Board members and has no bearing on data-subject rights; the deadlines above rest on the Section Five articles that carry them.

When LexLint raises it

  • crawls_web

Read the law

official statute text, Personal Data Protection Authority

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app