BahrainPersonal Data Protection Law, comprehensive regime and lawful basis
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Bahrain must obtain the Data Subject's consent or rely on a listed alternative lawful basis under the Personal Data Protection Law.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pdp.gov.bh/en/about-PDPA.html
- Guidance body
- Personal Data Protection Authority, Kingdom of Bahrain (overview page, About the Authority)
- Open questions
- What makes processing under Article 4, item 5, "not in conflict with fundamental rights and freedoms of the data subject", and who decides that before a Data Controller relies on its own legitimate interests instead of consent?
- Must consent under Article 4 be written and explicit, as the Authority's overview page states, when the Article itself requires only consent?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 8(1) requires a controller's technical and organizational security measures to be recorded and accessible to the Authority, the controller and the processor. The record is of the measures; the article names no log fields and no retention period. The Authority may reach the record, with no schedule stated. The cited articles carry no scope clause (the scope article, Article 2, is not among them), and the register of processing that Article 10 requires of the Data Protection Guardian or controller sits outside the cited range.
- Kind
- Explicit
- As of
- Provision
- Article 8(1)
- Trigger
- personal_data_processing
What this law does
The Personal Data Protection Law is Bahrain's comprehensive, consent-centric statute with enumerated grounds. Processing generally requires the Data Subject's consent or a listed alternative basis. A Controller/Processor structure is present, alongside a "Data Protection Guardian" role, Bahrain's DPO-equivalent. The Personal Data Protection Authority (PDPA), established by Art. 27, supervises compliance.
Roughly ten Ministerial Resolutions (Orders No. 42-51 of 2022) supply substantial operative detail; their content is not described here.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .