Bahrain

Art. 15 prohibits, without the PDPA's prior written authorisation, five listed operations including automatic processing of biometric data necessary for the verification of an individual's identity (Art. 15(2)), and processing by means of visual recording used for surveillance purposes (Art. 15(5)).

This sits in its own category distinct from Sensitive Personal Data (Art. 5) and genetic data (Art. 15(3)), gated by a heavier control than mere consent: ex ante regulatory authorisation before processing may begin at all. No modality-specific (voice or face) language was found.

Art. 15(2)'s framing is keyed to a verification use case; it is a genuine, unresolved textual question whether a biometric identifier created for a non-verification purpose (profiling, search, watchlist matching) falls within Art. 15(2) at all, or falls entirely outside both the Sensitive Personal Data consent rule and the Art. 15 prior-authorisation rule. Art. 15(5) independently reaches a faceprint derived from CCTV or similar recorded video used for surveillance. No retention or destruction duty specific to biometric data was found.

The Personal Data Protection Law is Bahrain's comprehensive, consent-centric statute with enumerated grounds. Processing generally requires the Data Subject's consent or a listed alternative basis. A Controller/Processor structure is present, alongside a "Data Protection Guardian" role, Bahrain's DPO-equivalent. The Personal Data Protection Authority (PDPA), established by Art. 27, supervises compliance.

Roughly ten Ministerial Resolutions (Orders No. 42-51 of 2022) supply substantial operative detail; their content is not described here.

Art. 12 prohibits transfer of personal data outside Bahrain except to a country on a PDPA-published adequacy whitelist (published in the Official Gazette), or under a case-by-case PDPA authorisation based on an adequacy assessment considering the data's nature, origin and destination, and relevant international agreements.

Art. 13 lists exemptions allowing transfer to a non-adequate destination without going through Art. 12: data-subject consent, a public-register transfer, contract necessity, vital-interest protection, legal obligation or court or prosecution order, and legal-claim preparation. This is a prohibition-with-listed-exceptions structure, the strictest transfer posture across this batch.

Section Five (Arts. 17-23) sets Bahrain's data-subject rights, each with its own working-day deadline. The Data Controller must notify a Data Subject who requests confirmation of processing within 15 working days (Art. 18(1)). It must halt or decline to begin direct-marketing processing and notify the Data Subject of its decision within 10 working days of a marketing objection (Art. 20(1)-(2)).

It must halt or decline to begin processing that causes material or moral damage within 10 working days of an objection on that ground (Art. 21(1)). It must respond to a rectification, blocking, or erasure request within 10 working days (Art. 23(1)).

Art. 17 separately requires the Data Controller to brief the Data Subject on the purposes of processing at the time data is obtained, Art. 19 requires notice of the right to object to direct marketing, and Art. 22 gives a Data Subject a right against a decision based solely on automated processing. Art. 32 (Conflict of Interest) governs PDPA Board members and has no bearing on data-subject rights; the deadlines above rest on the Section Five articles that carry them.

The Personal Data Protection Authority (PDPA), established by Art. 27, enforces the Law.

Penalties are dual-track: under Art. 58, imprisonment up to one year and/or a fine of BD 1,000 to BD 20,000 for a list of violations including unlawful sensitive-data processing (Art. 5), unlawful cross-border transfer (Arts. 12-13), failure to notify the Authority of processing (Art. 14), processing without Art. 15 prior authorisation, and providing false information or obstructing inspectors; Art. 58(2)'s separate BD 3,000 to BD 20,000 fine is for a PDPA Board member's or employee's own breach of the Art. 32 conflict-of-interest duty, not a Data Controller's data-handling violation.

Art. 59 doubles these fines for a legal person committing the offense in its name or for its benefit. Art. 55 supplies a separate administrative track: a daily compliance penalty (BD 1,000 per day on a first violation, BD 2,000 per day on a repeat violation within three years) and an administrative penalty up to BD 20,000, plus withdrawal of an Art. 15 authorisation.

Art. 57 gives a Data Subject a private right of action: a party who suffers damage from a Data Controller's or Data Protection Guardian's processing of their personal data, or from a Data Protection Guardian's violation of the Law, is entitled to claim compensation from the Data Controller or Data Protection Guardian, without prejudice to the Civil Law.

Art. 1's Sensitive Personal Data definition covers race, ethnical origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, and health or sexual status. Biometric data is absent from this list, the same gap found in Qatar's PDPPL; it is instead regulated separately under Art. 15 (see the biometric privacy instrument).

Art. 5(3) exempts data the Data Subject has made publicly available from the Sensitive Personal Data consent rule, but because biometric data is not itself Sensitive Personal Data, this exemption does not textually reach Art. 15's separate biometric prior-authorisation gate.

Article 21(1) permits, without the author's permission and without payment of compensation, reproducing a brief section of a legally published work to quote it in another work, provided the quotation serves a legitimate purpose and does not exceed the extent necessary for that purpose, with the source and author's name mentioned where indicated in the source.

Anyone who infringes a right protected under the Law, including by exceeding this exception's necessary extent, is subject to imprisonment of three months to one year and a fine of BD 500 to BD 4,000, or either penalty. Article 81 provides that the Law takes effect from the day following the date of its publication in the Official Gazette. No source located states the resulting day.

Article 3(2) protects, as a derivative work, a collection such as an encyclopedia or a database in a computer-readable or other format, whether the collection is created through the selection or arrangement of its contents, without prejudice to protection of the original works the collection draws on.

Article 4 separately excludes abstract ideas, data, statutes, court judgments, and bare news of current events from protection, but its closing sentence extends protection to a collection of that excluded material where the compilation is itself creative in its selection or arrangement.

Because data itself is on that Article 4 exclusion list, extracting the underlying facts or data from a compiled database falls outside this protection even where the compilation's own selection or arrangement is protected. Article 81 provides that the Law takes effect from the day following the date of its publication in the Official Gazette. No source located states the resulting day.

Rule OM-5.5.22 requires conventional bank licensees to conduct periodic assessments of cyber threats. Rule OM-5.5.25 requires conventional bank licensees to conduct regular technical assessments to identify potential security vulnerabilities for systems, applications and network devices.

Rule OM-5.5.31 requires conventional bank licensees to implement cyber security incident management processes for timely detection, response and recovery, including a Security Information and Event Management system. Rule OM-5.5.35 requires conventional bank licensees to establish a Security Operations Centre. Rule OM-5.5.45 requires conventional bank licensees to identify the critical systems and services that must be recovered on a priority basis.

Rule OM-5.5.53 requires conventional bank licensees to arrange to seek cyber risk insurance cover from a suitable insurer. Rule OM-5.5.55 requires the licensee to ensure that all employees receive adequate training on a regular basis in relation to cyber security and the threats they could encounter. No commencement notice for the provisions this entry describes has been located.

Rule RM-9.1.1 requires the Board of insurance licensees to ensure that the licensee has a robust cyber security risk management framework to manage its cyber security risk and vulnerabilities. Rule RM-9.1.3 requires the cyber security risk management framework to be developed in accordance with the National Institute of Standards and Technology (NIST) Cyber security framework. Rule RM-9.1.32 requires licensees to implement cyber security incident management processes for timely detection, response and recovery.

Rule RM-9.1.46 requires licensees to identify the critical systems and services that must be recovered on a priority basis. Rule RM-9.1.54 requires licensees to arrange to seek cyber risk insurance cover from a suitable insurer. Rule RM-9.1.56 requires the licensee to ensure that all employees receive adequate training on a regular basis in relation to cyber security and the threats they could encounter. No commencement notice for the provisions this entry describes has been located.

Rule OM-5.5.57 requires conventional bank licensees that detect a cyber security incident, whether internal or external, that compromises customer information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule OM-5.5.57 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.

Rule OM-5.5.58 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule OM-5.5.58 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule OM-5.5.59 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet. No commencement notice for the provisions this entry describes has been located.

Rule Cyber Resilience Act (CRA)-5.8.33 requires licensees that detect a cyber security incident, whether internal or external, that compromises client information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule CRA-5.8.33 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.

Rule CRA-5.8.34 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule CRA-5.8.34 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule CRA-5.8.35 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet. No commencement notice for the provisions this entry describes has been located.

Rule RM-9.1.58 requires licensees that detect a cyber security incident, whether internal or external, that compromises customer information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule RM-9.1.58 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.

Rule RM-9.1.59 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule RM-9.1.59 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule RM-9.1.60 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet. No commencement notice for the provisions this entry describes has been located.

Rule RM-9.1.58 requires licensees that detect a cyber security incident, whether internal or external, that compromises customer information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule RM-9.1.58 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.

Rule RM-9.1.59 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule RM-9.1.59 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule RM-9.1.60 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet. No commencement notice for the provisions this entry describes has been located.

Rule OM-5.5.57 requires Islamic bank licensees that detect a cyber security incident, whether internal or external, that compromises customer information or disrupts critical services that affect operations to contact the Central Bank of Bahrain immediately, within one hour. Rule OM-5.5.57 requires the licensee to submit Section A of the Cyber Security Incident Report to the Central Bank of Bahrain's cyber incident reporting email within two hours.

Rule OM-5.5.58 requires the licensee to submit Section B of the Cyber Security Incident Report within 10 calendar days of the occurrence of the incident. Rule OM-5.5.58 requires a weekly progress update to the Central Bank of Bahrain until the incident is fully resolved. Rule OM-5.5.59 says the licensee should submit the report with as much information as possible even if all the details have not been obtained yet. No commencement notice for the provisions this entry describes has been located.

Article 4(3) excludes news of current events that may merely be news reports from copyright protection, so a bare fact or news item is never a protected work in Bahrain, whichever outlet reports it first; the Article's closing sentence nonetheless protects a collection of such items where the compilation is itself creative in its selection or arrangement.

Article 21(1) separately permits, without the author's permission and without payment of compensation, reproducing a brief section of a legally published work to quote it in another work, provided the quotation serves a legitimate purpose and does not exceed the extent that purpose requires, with the source and author's name mentioned where the source indicates them.

Neighbouring rights under the Law, covering performing artists and broadcasting organizations, do not extend to a print or online news publisher's own reporting. Article 81 provides that the Law takes effect from the day following the date of its publication in the Official Gazette. No source located states the resulting day.