Bahrain

Article 2 applies the law to processing by a data controller with a place of business in Bahrain, to a person habitually resident in Bahrain, and to 'every natural or legal person not habitually resident nor maintains a place of business in the Kingdom, but processes data by using means situated in the Kingdom' unless those means are used only to transmit data through Bahrain. Article 2(3) requires the appointment of an authorised representative and immediate notification of that appointment to the Authority. The extraterritorial hook is equipment-based rather than targeting-based, so it is narrower than the European or Indian tests but wider than it looks for anyone using Bahraini infrastructure.

SECTOR BY SECTOR, checked 18 August 2026. Banking, insurance, securities and payments (all supervised by the Central Bank of Bahrain): no rule requiring data to stay in Bahrain, but a licensee needs the central bank's prior approval to outsource anything to a third party outside Bahrain, and must notify the central bank after the fact for cloud arrangements inside or outside Bahrain; cloud rules require a risk-based choice of hosting country and forbid hosting where the regulator's access to information could be blocked, or in countries under United Nations sanctions. Government: the state's own Cloud First Policy openly rejects residency restrictions for government workloads, subject to classification and state-secrets rules. Health, telecommunications, education, geospatial and mapping, and defence: no localisation or sector transfer rule found on the regulators' own sites, checked 18 August 2026, medium confidence - see the unconfirmed list. Gambling: commercial gambling is not licensed in Bahrain, so there is no gaming data regime to check. The single most important point is that the general law does the work here: Bahrain restricts transfers at the national level and then leaves industries alone, which is the reverse of the pattern in India or Saudi Arabia.

Article 12 bans transfer outside Bahrain except to a country the Authority has listed as offering adequate legislative and regulatory protection, or with a case-by-case authorisation which may be made conditional or time-limited. Order No. 42 of 2022 is the list. Article 13 sets out the exceptions. There is no standard contract clause regime, no binding corporate rules, no certification route: Bahrain never built one. Note that 'adequate' in Bahrain does not mean what it means in Europe - the same order lists the United States, China and Russia - so a transfer that is lawful under Bahraini law can still breach European rules, and vice versa.

Royal Decree No. 78 of 2019, in force 29 September 2019, states that the Minister of Justice, Islamic Affairs and Waqf assumes the duties and powers of the Authority's board of directors and chairman, and the ministry's undersecretary the role of chief executive, pending a financial allocation in the state budget and a decree forming the board. The Authority's own website still shows that decree as the governing arrangement and names no board members or chief executive. Enforcement of the criminal penalties in the law runs through the Public Prosecution and the courts rather than through administrative fining powers, which is one reason the public record is thin. We could not find any published enforcement decision, fine or annual report, and record that as an explicit gap rather than as evidence that nothing has happened.

Article 3(5) of the law is the ceiling. Order No. 43 of 2022 requires controllers to regulate their data retention and disposal periods as part of the technical and organisational measures. The five-year floor sits in the Financial Cybersecurity Controls issued by the National Cyber Security Centre for financial entities: control 6.1.8 requires a security information and event management system with a log retention period of five years or longer, and control 6.1.10 makes log retention track the cyber centre's requirements. The draft payment service provider module the central bank put out for consultation in February 2026 also uses a five-year record floor. Tax and company-law floors almost certainly exist - Bahrain runs value added tax and a commercial companies law - but the government legislation portal was unreachable from our network, so we do not assert them here. Where a floor and the ceiling collide, the specific keeping obligation wins and the general delete-when-done rule bends around it; we could not find an official Bahraini statement of that principle, so it is reasoning, not a quoted rule.

The 72-hour clock is not in the statute - the law itself is silent on breach reporting - it comes from article 4 of Order No. 43 of 2022 on technical and organisational measures. That order also sets out what the notification must contain for both the regulator and the individual, and lets a controller replace individual notice with a public announcement where individual notice would take disproportionate effort. Financial entities additionally sit under the Financial Cybersecurity Controls, which require an incident response plan, incident classification and reporting arrangements; the copy published by the central bank is a scanned document whose specific reporting deadline we could not extract, so we do not state one. The practical trap is the overlap: one incident, two regulators, and the shorter clock is the one that governs.

Penalties sit in article 58: imprisonment up to one year and/or a fine of not less than 1,000 and not more than 20,000 Bahraini dinars for a list of breaches that expressly includes transferring data outside Bahrain contrary to articles 12 and 13, processing without the required notification or prior authorisation, and unlawful disclosure. Prior notification is article 14, with narrow exemptions including where a data protection guardian has been appointed and registered - that appointment is the standard way to escape the notification treadmill. Prior authorisation is article 15 and covers sensitive personal data, biometric data used to identify people, genetic data, linking data sets held by different controllers, and visual surveillance recording; Order No. 44 of 2022 confirms the thirty-day decision window and that silence is an implied rejection, and requires a data protection impact assessment for biometrics and surveillance. Sensitive data in Bahrain expressly includes race, political or philosophical opinions, religious belief, union membership, criminal record and health data.

DORMANT SWITCHES. One: the list of adequate countries is an executive order of the Minister of Justice, so a country can be added or removed overnight with no consultation - a company routing data to a country that comes off the list would be exposed to criminal liability, not just an order to stop. Two: Royal Decree No. 78 of 2019 is expressly interim, conditional on a budget allocation and a decree forming the board; once that decree issues, Bahrain goes from a ministry side-desk to a standing regulator, and the ten orders already on the books become enforceable by a body with staff. Three: the National Cyber Security Centre is operating a national strategy for 2025 to 2028 and issues controls documents for critical sectors, which is the most likely source of new hard obligations. We found no bill amending Law No. 30 of 2018 - but note that the government legislation portal was unreachable from our network, so a pending bill could exist that we did not see.