16 May 2019
BAHRAIN: New Data Protection Law to Take Effect from 1 August
Bahrain is set to implement the Personal Data Protection Law No. 30 of 2018, one of the four new laws designed to help boost foreign direct investment (FDI) inflows to the Gulf state. The law, which will be effective from 1 August 2019, will provide a clear framework for personal data processing for commercial use, as well as data transfer across borders and is seen as helping to spur the kingdom’s digital economy.
It will cover individuals and businesses operating in the country, overseas corporations that process personal data “by means available within the Kingdom other than for purely transitory purposes,” and non-Bahraini organisations running data centres or using third party data processors in the country.
The law defines data as any information relating to an identified or identifiable individual, with its provisions ensuring their integrity and confidentiality, as well as fair and lawful processing of data collected for legitimate, specific, and clear purposes only. Under the law, consent is required prior to processing. If the personal data will be transferred outside Bahrain, the destination should only be within jurisdictions approved by the Data Protection Authority, which is set to be established by the government.
The law does, however, provides exemptions. For example, in terms of data transfer to jurisdictions not approved by the Data Protection Authority, the transfer may be allowed if the owner of the personal data gives consent, or if the transfer falls under a specific exception cited within the law.
The law requires data controllers or data managers to have written contracts with third parties that process personal data on their behalf. They may also select a Data Protection Supervisor, an accredited third party, to monitor and verify compliance, assist them in exercising their rights and fulfilling their obligations, and act as a coordinator between them and the Data Protection Authority. Criminal and administrative punishments will be imposed on businesses that fail to comply with the law, which is modelled after globally accepted regulations.
The government hopes to boost investor confidence in the local economy by demonstrating its commitment to building a data-driven market through transparent regulations and laws.