Bahrain's New Data Protection Law Now In Force

On August 1, 2019, Bahrain's Personal Data Protection Law (PDPL) (Law No. (30) of 2018) took effect. The PDPL aims to align Bahrain's data protection framework more closely with global best practices and regulates the processing (broadly defined to include collection, storing, revealing, etc.) and transfer of data in Bahrain. Although the law is now in effect, Bahrain has yet to establish the new Personal Data Protection Authority (the “Authority”) that will enforce the law.

Bahrain's adoption of the PDPL may be part of a trend among members of the Gulf Cooperation Council (GCC) toward increased data protection oversight. The United Arab Emirates and Saudi Arabia, for example, may both introduce more comprehensive data protection laws in the coming years1.

The PDPL includes criminal penalties for certain violations. Data protection laws in the European Union and the United States, in contrast, are generally civil in nature. Criminal violations include the processing of sensitive personal data in contravention of the PDPL or withholding data, information, records or documents requested by the Authority.

The law applies to individuals living and working in Bahrain; organizations with a place of business in Bahrain; and people and organizations that are not present in Bahrain but that process data using means (independently or through third parties) available in Bahrain, unless such processing is solely for the purpose of passing data through Bahrain. The law follows a somewhat analogous dichotomy to the European Union's General Data Protection Regulation (GDPR) in defining two main roles with regard to data: (1) data manager, the person who decides (solely or in conjunction with others) the purposes and means of processing; and (2) data processor, the person who processes the data for and on behalf of the data manager.

The collection, processing and transfer of data or personal data and sensitive personal data is protected by the PDPL. Different restrictions apply to the different categories of information.Data or personal data is defined as information in any form that is related to an identifiable individual or an individual who can be identified, directly or indirectly, through an identifying factor (e.g., personal ID number, physical, cultural or economic factors).Sensitive personal data is a subset of personal data that reveals, directly or indirectly, an individual's race, ethnicity, political or philosophical views, religious beliefs...