Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Bahrain's Personal Data Protection Law (Law No. 30 of 2018), in force since August 2019, was the first standalone data protection statute in the GCC and is enforced by the Personal Data Protection Authority (PDPA), which operates under the Ministry of Justice, Islamic Affairs and Waqf.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Bahrain's general personal data protection law, enacted 12 July 2018 and effective 1 August 2019, drawing on EU-style data protection concepts (lawful basis, data subject rights, cross-border transfer restrictions) while retaining its own enforcement and penalty structure.
Source72 hours
Controllers must notify the PDPA of any data breach within 72 hours of its date of discovery; where notification is not made within that window, a documented justification for the delay is required. Where a breach is likely to result in high risk to data subjects, affected individuals must also be notified without undue delay.
Notify: Personal Data Protection Authority (PDPA)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
PDPL Law No. 30 of 2018, criminal and administrative provisions
BHD 1,000-20,000 fine and/or up to 1 year imprisonment for natural persons for criminal violations (e.g. processing without consent, unauthorized sensitive-data processing, unauthorized cross-border transfer); fines may be doubled for corporate violators (up to BHD 40,000)
Separate administrative (non-criminal) penalties include daily fines for ongoing violations plus lump-sum administrative fines up to BHD 20,000, the exact administrative-vs-criminal boundary is described inconsistently across secondary sources and should be confirmed against current PDPA regulations before treating as final.
SourceNot applicable , as of 2026-09-08
Personal Data Protection Authority(PDPA)
Visit authority siteThe Personal Data Protection Authority (PDPA), which by Royal Decree No. 78 of 2019 operates under Bahrain's Ministry of Justice, Islamic Affairs and Waqf.
Controllers must notify the PDPA within 72 hours of discovering a breach, and must justify any delay beyond that window in the notification itself.
Yes. Criminal violations under the PDPL carry fines of BHD 1,000-20,000 and/or up to one year of imprisonment for natural persons, with fines potentially doubled for corporate entities.
Talk to us about scoping an engagement around your specific regulatory context.
