Bahrain

Article 2 applies the law to three groups. First, a company that decides how data is used and has a place of business in Bahrain. Second, a person who normally lives in Bahrain. Third, 'every natural or legal person not habitually resident nor maintains a place of business in the Kingdom, but processes data by using means situated in the Kingdom'. That third group is excluded where those means are used only to pass data through Bahrain. Article 2(3) requires you to appoint an authorised representative and tell the Authority about the appointment immediately. The law reaches you through the equipment you use, not through who you sell to. That makes it narrower than the European or Indian tests. But it is wider than it looks for anyone using Bahraini infrastructure.

INDUSTRY BY INDUSTRY, checked 18 August 2026. Banking, insurance, securities and payments, all supervised by the Central Bank of Bahrain: no rule requires data to stay in Bahrain. But a licence holder needs the central bank's prior approval to hand any work to a supplier outside Bahrain. For cloud arrangements, inside or outside Bahrain, it must tell the central bank afterwards. The cloud rules make you pick the hosting country on a risk basis. You may not host where the regulator's access to information could be blocked, or in countries under United Nations sanctions. Government: the state's own Cloud First Policy openly rejects any rule that data must stay in the country for government systems. That is subject to classification and state-secrets rules. Health, telecommunications, education, geospatial and mapping, and defence: we found no rule forcing data to stay in the country, and no separate transfer rule, on the regulators' own sites. Checked 18 August 2026, medium confidence. See the unconfirmed list. Gambling: commercial gambling is not licensed in Bahrain, so there are no gaming data rules to check. The single most important point is that the general law does the work here. Bahrain restricts transfers at national level and then leaves industries alone. That is the reverse of the pattern in India or Saudi Arabia.

Article 12 bans sending data outside Bahrain. There are two ways round it. The country is on the Authority's list of places offering adequate legislative and regulatory protection. Or you get a one-off authorisation, which may come with conditions or a time limit. Order No. 42 of 2022 is the list. Article 13 sets out the exceptions. There is no standard contract clause system, no group-wide rules and no certification route. Bahrain never built one. Watch out: 'adequate' in Bahrain does not mean what it means in Europe. The same order lists the United States, China and Russia. So a transfer that is lawful under Bahraini law can still break European rules, and the other way round.

Royal Decree No. 78 of 2019 came into force on 29 September 2019. It says the Minister of Justice, Islamic Affairs and Waqf takes on the duties and powers of the Authority's board of directors and chairman. The ministry's undersecretary takes the role of chief executive. This lasts until the state budget allocates money and a decree forms the board. The Authority's own website still shows that decree as the governing arrangement, and names no board members or chief executive. The criminal penalties in the law are enforced through the Public Prosecution and the courts, not through administrative fining powers. That is one reason the public record is thin. We could not find any published enforcement decision, fine or annual report. We record that as a gap, not as evidence that nothing has happened.

Article 3(5) of the law is the deletion rule. Order No. 43 of 2022 makes you set your own data keeping and disposal periods, as part of your technical and organisational measures. The five-year minimum sits in the Financial Cybersecurity Controls, issued by the National Cyber Security Centre for financial firms. Control 6.1.8 requires a security information and event management system with a log keeping period of five years or longer. Control 6.1.10 makes log keeping follow the cyber centre's requirements. The draft payment service provider module the central bank put out for comment in February 2026 also uses a five-year record minimum. Tax and company-law minimums almost certainly exist. Bahrain runs value added tax and has a commercial companies law. But the government legislation portal was unreachable from our network, so we do not state them here. Where a minimum keeping period and the delete-when-done rule clash, the specific keeping duty wins. We could not find an official Bahraini statement of that, so it is our reasoning, not a quoted rule.

The 72-hour deadline is not in the statute. The law itself says nothing about breach reporting. The deadline comes from article 4 of Order No. 43 of 2022 on technical and organisational measures. That order also sets out what the notice must contain, both for the regulator and for the individual. It lets you replace individual notices with a public announcement where individual notice would take disproportionate effort. Financial firms also sit under the Financial Cybersecurity Controls. Those require an incident response plan, incident classification and reporting arrangements. The copy published by the central bank is a scanned document. We could not extract its specific reporting deadline, so we do not state one. The trap is the overlap. One incident, two regulators, and the shorter deadline is the one that governs.

Penalties sit in article 58. They are imprisonment up to one year and/or a fine of not less than 1,000 and not more than 20,000 Bahraini dinars. They apply to a list of breaches. That list expressly includes sending data outside Bahrain contrary to articles 12 and 13, using data without the required notification or prior authorisation, and unlawful disclosure. Prior notification is article 14. Its exemptions are narrow. One of them is where a data protection guardian has been appointed and registered. Appointing one is the standard way to escape the repeated notification duty. Prior authorisation is article 15. It covers sensitive personal data, biometric data used to identify people, genetic data, linking data sets held by different companies, and visual surveillance recording. Order No. 44 of 2022 confirms the thirty-day decision window, and that silence counts as a refusal. It also requires a data protection impact assessment for biometrics and surveillance. Sensitive data in Bahrain expressly includes race, political or philosophical opinions, religious belief, union membership, criminal record and health data.

POWERS THE GOVERNMENT CAN USE WITHOUT WARNING. One: the list of adequate countries is an executive order of the Minister of Justice. A country can be added or removed overnight with no consultation. A company routing data to a country that comes off the list would face criminal liability, not just an order to stop. Two: Royal Decree No. 78 of 2019 is expressly temporary. It depends on a budget allocation and a decree forming the board. Once that decree issues, Bahrain goes from a ministry side-desk to a standing regulator. The ten orders already on the books become enforceable by a body with staff. Three: the National Cyber Security Centre is running a national strategy for 2025 to 2028 and issues control documents for critical industries. That is the most likely source of new hard duties. We found no bill amending Law No. 30 of 2018. But the government legislation portal was unreachable from our network, so a pending bill could exist that we did not see.