Regulationsby GlyphBahrain PDPL
In force Bahrain · In force Aug 1, 2019 · no upcoming deadlines
Deadlines
PDPL takes effectArticle 4 of the issuing law says the law applies from the first day of the month after one year from Gazette publication.
Summaries for reference, not legal advice. Check the official text.
What it does
Bahrain's general data protection law. It sets lawful bases for processing, stricter rules for sensitive data, individual rights, transfer limits and registration duties, and creates the Personal Data Protection Authority. It carries both administrative and criminal penalties.
- Who it applies to
- Individuals and entities that process personal data in Bahrain, and those outside Bahrain that process data using means in Bahrain.
- Penalties
- Administrative fines up to BHD 20,000 and daily fines up to BHD 1,000 (BHD 2,000 for repeats). Criminal penalties of up to one year in prison and fines of BHD 1,000 to 20,000 for offences such as unlawful sensitive data processing or unlawful transfers (Art. 58).
- Enforced by
- Personal Data Protection Authority (Art. 27)
- Official name
- Law No. 30 of 2018 on the Protection of Personal Data
- Citation
- Law No. (30) of 2018
- Topics
- Privacy
Verified 2026-09-25
Research notes
Issue date 12 July 2018 is on the LLOC text. The Gazette publication date is not shown on that page; 2019-08-01 assumes publication in July 2018, so the deadline is marked tentative.
Related
Egypt PDPLEgypt's data protection law covers personal data processed electronically. It sets consent and lawful processing rules, strict rules for sensitive data and cross-border transfers, and a licensing and permit system run by the Personal Data Protection Center. The Executive Regulations were only issued in November 2025, which starts a one-year window to comply.Next: Nov 2 One-year compliance window ends · in 6 days
Israel Privacy Protection Law Amendment 13Major overhaul of Israel's privacy law: broadens definitions (personal and highly sensitive information), narrows database registration, requires privacy protection officers for certain entities, and gives the Privacy Protection Authority powers to impose large administrative fines and orders, plus statutory damages.In effect since Aug 14, 2025
Kenya Data Protection ActKenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).In effect since Nov 25, 2019
Nigeria NDPANigeria's primary data protection statute, establishing the NDPC, lawful bases, data subject rights, 72-hour breach notification, and special duties for data controllers and processors of major importance (registration, DPO, compliance audits). The GAID 2025 supersedes the NDPR 2019 and its Implementation Framework with detailed rules on audits, DPIAs, transfers and more.In effect since Jun 12, 2023Rwanda DPP LawRwanda's data protection law, modelled on the GDPR. Controllers and processors must register with the supervisory authority, report breaches within 72 hours, and store personal data in Rwanda unless they hold a certificate allowing storage abroad. Cross-border transfers need authorisation or another listed ground.In effect since Oct 15, 2021
Saudi PDPLSaudi Arabia's comprehensive data protection law with implementing regulations and separate transfer regulations: legal bases, data subject rights, breach notification to SDAIA within 72 hours, DPO and registration requirements, and restrictions on transfers outside the Kingdom.In effect since Sep 14, 2023
South Africa POPIASouth Africa's comprehensive data protection law built on eight conditions for lawful processing, with Information Officer registration, security compromise notification to the Regulator and data subjects, and restrictions on direct marketing and cross-border transfers. Protects juristic persons as well as individuals.In effect since Jul 1, 2020
UAE Child Digital Safety LawSets child safety duties for internet service providers and digital platforms that operate in or target the UAE, from social media and games to e-commerce. Platforms may not process personal data of children under 13 without verifiable parental consent and must use age verification and risk-based controls. A 2026 Cabinet Resolution bars social media accounts for children under 15 and restricts accounts for 15 year olds.Next: Jan 1, 2027 Compliance deadline under the Decree by Law · in 2 months
Questions about Bahrain PDPL
- What are the Bahrain PDPL compliance deadlines?
- Aug 1, 2019: PDPL takes effect (tentative).
- When does Bahrain PDPL take effect?
- Bahrain PDPL took effect on Aug 1, 2019.
- Who does Bahrain PDPL apply to?
- Individuals and entities that process personal data in Bahrain, and those outside Bahrain that process data using means in Bahrain.
- What are the penalties under Bahrain PDPL?
- Administrative fines up to BHD 20,000 and daily fines up to BHD 1,000 (BHD 2,000 for repeats). Criminal penalties of up to one year in prison and fines of BHD 1,000 to 20,000 for offences such as unlawful sensitive data processing or unlawful transfers (Art. 58).