BahrainPersonal Data Protection Law, enforcement and penalties
Law No. 30 of 2018, Arts. 55, 57-60
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app processing the personal data of an individual in Bahrain without the required lawful basis, prior authorisation, or transfer safeguard risks both criminal penalties (imprisonment and fines up to BD 20,000) and administrative penalties (up to BD 20,000, plus a daily compliance penalty on repeat violation) from the Personal Data Protection Authority, and a data subject who suffers damage from unlawful processing may separately claim compensation directly from the app under Art. 57.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Art. 58(1) criminalizes nine categories of Data Controller misconduct: unlawful sensitive-data processing (Art. 5), unlawful cross-border transfer (Arts. 12-13), failure to notify the Authority of processing (Art. 14(1)), failure to notify a change to a notified processing operation (Art. 14(6)), processing without the Art. 15 prior authorization, giving the Authority or a data subject false or misleading data, withholding data from the Authority, obstructing inspectors or an investigation, and an insider's unlawful disclosure or use of data. Each is punishable by imprisonment for a term not exceeding one year, and/or a fine of not less than BD 1,000 and not exceeding BD 20,000. Art. 59 doubles both fine limits, BD 2,000 to BD 40,000, where the offense is committed in a legal person's name or for its benefit, attributable to a board member's, delegated official's or agent's act, omission, approval, cover-up, or gross negligence. A narrower Art. 58(2) fine of BD 3,000 to BD 20,000 applies only to a PDPA Board member's or employee's own breach of the Art. 32 conflict-of-interest duty, not to a Data Controller's data-handling violation, so it is not counted as this instrument's criminal exposure to a regulated app. Art. 60 lets the Board offer conciliation, which ends the criminal proceeding on payment of the minimum fine within 7 days, for the Art. 58(1) notification, updated-notification, and unauthorized-processing offenses (paragraphs 1/c-1/e).
Penalty structure
Art. 55(1) empowers the PDPA Board, once a violation is established and the offender fails to comply with the Board's stop order, to issue reasoned resolutions choosing among: withdrawing an Art. 15 authorization; imposing a daily compliance penalty of BD 1,000 per day for a first violation, escalating to BD 2,000 per day for a second violation within three years of the first decision, uncapped in total and running until the violation is stopped; or imposing a separate, one-off administrative penalty not exceeding BD 20,000. The BD 20,000 figure is that separate administrative penalty's own ceiling, not an aggregate cap on the daily compliance penalty, which the statute leaves open-ended. This administrative track is independent of the criminal fines under Arts. 58-59 (see the criminal exposure note) and of the Art. 57 private compensation claim.
- Rule
- Per violation only
- As of
- Currency
- BHD
- Per violation unit
- Day
- Per violation amount
- 1,000
Over one month of continuous breach, BHD 30,440.
Who enforces it
Enforcement body
Personal Data Protection Authority (PDPA)
Settledness
The Authority's Executive Decisions/Orders page lists an order on the rules and procedures governing submission of complaints; it is an implementing instrument, not guidance.
- As of
- Open questions
- Must a party claiming compensation under Article 57 show that the processing violated the Law, or is damage "resulting from processing of his personal data by the Data Controller" compensable whether or not the processing was lawful?
What it reaches
Obligation class
Governance
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- every natural person who is habitually resident in the Kingdom or maintains a place of business in the Kingdom
- every legal person with a place of business in the Kingdom
- every natural or legal person not habitually resident nor maintains a place of business in the Kingdom, but processes data by using means situated in the Kingdom, unless such means are used only for purposes of transit of data over the Kingdom’s territory
What it makes you log
Logging duty
Article 55 sets the Board's orders, daily penalties and administrative penalty of up to BD 20,000, Article 57 gives a damages claim, and Articles 58 to 60 set the criminal penalties, corporate liability and conciliation. None asks the controller to keep a log. The row's own text presupposes the Authority's power to inspect and to demand records: Article 58 makes it an offence to withhold from the Authority any data, information, records or documents to which it should have access, or to prevent or delay its inspectors. The power itself is set out in Articles 47 to 49, which the row does not cite. The cited articles carry no territorial clause.
- Kind
- None
- As of
What this law does
The Personal Data Protection Authority (PDPA), established by Art. 27, enforces the Law.
Penalties are dual-track: under Art. 58, imprisonment up to one year and/or a fine of BD 1,000 to BD 20,000 for a list of violations including unlawful sensitive-data processing (Art. 5), unlawful cross-border transfer (Arts. 12-13), failure to notify the Authority of processing (Art. 14), processing without Art. 15 prior authorisation, and providing false information or obstructing inspectors; Art. 58(2)'s separate BD 3,000 to BD 20,000 fine is for a PDPA Board member's or employee's own breach of the Art. 32 conflict-of-interest duty, not a Data Controller's data-handling violation.
Art. 59 doubles these fines for a legal person committing the offense in its name or for its benefit. Art. 55 supplies a separate administrative track: a daily compliance penalty (BD 1,000 per day on a first violation, BD 2,000 per day on a repeat violation within three years) and an administrative penalty up to BD 20,000, plus withdrawal of an Art. 15 authorisation.
Art. 57 gives a Data Subject a private right of action: a party who suffers damage from a Data Controller's or Data Protection Guardian's processing of their personal data, or from a Data Protection Guardian's violation of the Law, is entitled to claim compensation from the Data Controller or Data Protection Guardian, without prejudice to the Civil Law.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .