Bahrain Personal Data Protection Law — Tsaaro

The Bahrain Personal Data Protection Law (PDPL) is a comprehensive data protection law that regulates the processing of personal data in Bahrain. The law was enacted in August 2018 and came into effect in August 2019, replacing the previous data protection regulations.

The PDPL applies to all individuals and organizations that process personal data in Bahrain, regardless of their size or location. The law aims to protect the privacy rights of individuals by ensuring that personal data is processed lawfully, fairly, and transparently.The PDPL is applicable to all Bahraini residents and employees, as well as to locally and internationally operated businesses that process personal data "by means available in the Kingdom" other than for solely transitory purposes. As a result, non-Bahraini companies that run data centre or use outside data processors in Bahrain will be subject to the PDPL.

After the original reason for collection or the following processing, the data cannot be kept in a way that makes it possible to identify the data subject. Long-term data storage for historical, statistical, or scientific reasons must be done in an anonymized format, which prevents the owner of the data from being connected to it. Additionally, it must be made sure that the name of the data's owners cannot be decoded.

Under the PDPL, personal data is defined as any information that relates to an identified or identifiable natural person. This includes information such as names, addresses, identification numbers, and biometric data.

The PDPL requires organizations to obtain consent from data subjects before processing their personal data and to provide data subjects with certain rights, such as the right to access their data and the right to request corrections or deletions.

The law also requires organizations to implement appropriate technical and organizational measures to protect personal data and to notify the authorities and data subjects of any data breaches

The Labour Law mandates that employers must keep a record with information about their workers when it comes to employment. Name, age, housing number, marital status, place of residence, nationality, job, occupation, wages, qualifications, and experience are examples of this type of information. After the employment connection has ended, the employer must keep the aforementioned data for at least two years. Instead of the legal justification for lawful processing under the Law, the obligation outlined in the Labour Law gives employers in this situation the right to keep and process the data of their workers. (Article 68 of the Labour Law).

The Data Protection Authority (DPA) is responsible for enforcing the PDPL and has the power to investigate complaints, issue fines and sanctions, and order organizations to take corrective action.Facilitated accessibility, relevance to purpose, consent of the data subject, and a way to allow the data subject to update or delete their personal data in the public register are criteria for developing data registries that are accessible to the general public. The nature, function, and date of the most recent data update must all be stated in the public registry.

In summary, the Bahrain Personal Data Protection Law is an important piece of legislation that aims to protect the privacy rights of individuals and ensure that personal data is processed in a fair and transparent manner.

The PDPL also extends to businesses that process the personal data of Bahraini citizens outside of Bahrain, not just those with a Bahraini base of operations. No matter where personal data is processed, it is secured thanks to the law's extraterritorial application. Bahrain's dedication to safeguarding personal information and adhering to international data security standards is also demonstrated by the PDPL. The General Data Protection Regulation (GDPR) of the European Union and other international data protection laws are in compliance with the legislation. This alignment supports a global standard for data security and makes cross-border data transfers easier.

click here to read more about Bahrain Personal Data Protection Law