Catching The Wave: New Data Protection Law In Bahrain

Bahrain's Law on the Protection of Personal Data was published on 19 July 2018, and will come into effect on 1 August 2019. The Law will require a variety of changes to the way businesses process personal data in Bahrain or about residents of Bahrain. Data protection has not been a high priority topic for most businesses in Bahrain, with the limited exception of international entities subject to data protection requirements in other jurisdictions in which they operate. While the publication of the new Law provides a considerable lead-in period within which entities subject to the Law will need to comply, the fact that the Law creates criminal offences means that compliance is all the more important and should be treated as a high priority.

Until now, and with one exception (namely, Qatar), none of the Gulf Cooperation Council member states had a modern, nationally applicable data protection law. Legal issues relating to privacy and data protection are typically analysed in terms of general, and ill-fitting, criminal provisions relating to the unauthorized disclosure of secrets, or - in appropriate circumstances - industry-specific obligations relating to healthcare or credit data, or telecommunications sector subscriber data.

The Law is generally composed of 60 articles divided into three broad sections or 'titles'. These are:

Title 1: Processing Provisions - Including definitions and general rules for the legality of processing, controls of data processing and transfer, statements as well as the rights of the data holder. Title 2: Data Protection Authority - Including provisions relating to the establishment of the regulator, and its rights and responsibilities. Title 3: Accountability of the data manager (data controller) and data processor - Including provisions relating to accountability to the regulator, investigation procedures, civil and criminal liability, and penalties for violation. In this article, we consider some key areas addressed in the Data Protection Law.

Application

Bahrain's Data Protection Law describes the legal protection of personal privacy as among the main constitutional rights of the person, and notes that it should be protected, particularly in the context of the increasing use of electronic/digital means for processing information.

The Law applies to:

Every individual residing normally in Bahrain or having a workplace in Bahrain, and every legal person (corporate) having a place of business in the Kingdom of...