BahrainPersonal Data Protection Law, data subject rights
Law No. 30 of 2018, Arts. 17-23
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that receives a data-subject request from an individual in Bahrain must respond within a fixed working-day deadline, ten or fifteen working days depending on the request type, rather than an open-ended reasonable-time standard.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Authority's Executive Decisions/Orders page lists an order on the Data Subject's rights; it is an implementing instrument, not guidance.
- As of
- Guidance link
- https://www.pdp.gov.bh/en/about-PDPA.html
- Guidance body
- Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority)
- Open questions
- Does "reliability or conduct" in Article 22 reach an automated score of a user's behavior on a service, or only an assessment of the data subject at work or in a credit setting?
What it makes you log
Logging duty
Articles 17 to 23 give the data subject information, access, objection and rectification rights with response times of 10 to 15 working days. They require a controller to answer and notify, not to keep a log or record, and the cited articles carry no territorial clause.
- Kind
- None
- As of
What this law does
Section Five (Arts. 17-23) sets Bahrain's data-subject rights, each with its own working-day deadline. The Data Controller must notify a Data Subject who requests confirmation of processing within 15 working days (Art. 18(1)). It must halt or decline to begin direct-marketing processing and notify the Data Subject of its decision within 10 working days of a marketing objection (Art. 20(1)-(2)).
It must halt or decline to begin processing that causes material or moral damage within 10 working days of an objection on that ground (Art. 21(1)). It must respond to a rectification, blocking, or erasure request within 10 working days (Art. 23(1)).
Art. 17 separately requires the Data Controller to brief the Data Subject on the purposes of processing at the time data is obtained, Art. 19 requires notice of the right to object to direct marketing, and Art. 22 gives a Data Subject a right against a decision based solely on automated processing. Art. 32 (Conflict of Interest) governs PDPA Board members and has no bearing on data-subject rights; the deadlines above rest on the Section Five articles that carry them.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .