Law: Law No. (30) of 2018 with Respect to Personal Data Protection Law (the Law)

Regulator: Ministry of Justice and Islamic Affairs (MoJ)

Summary: Law No. (30) of 2018 with Respect to Personal Data Protection Law (the Law) entered into force on August 1, 2019, and sets a relatively comprehensive basis for personal data protection, although certain matters, such as the appointment of data protection officers, have been left to the Ministry of Justice and Islamic Affairs (MoJ) to regulate.

The Law provides a legal basis for personal data processing, principles, controller and processor obligations, including the obligation to notify the MoJ before commencement of data processing, and a general prohibition on cross-border data transfers and exceptions. The MoJ is responsible for enforcing the Law and has issued enforcement decisions and guidelines supplementing the provisions of the Law.

Although there is a comprehensive data protection law, certain existing provisions in Bahrain's legislation remain enforceable and govern data protection in specific sectors. For example, Labor Law 2012 covers data protection in the context of employer-employee relationships, and the Real Estate Regulatory Authority (RERA) recently announced the adoption of a resolution on anti-money laundering in the context of real estate. Bahrain is also notable for its increasing regulation of its financial sector. The MoJ, however, still has a wide range of duties, including the authorization of data transfers outside the Kingdom of Bahrain and the monitoring of compliance with the Law.