← Global Privacy Laws Research Library
Law No. 30 of 2018 with Respect to Personal Data Protection
Personal Data Protection Law No. 30 of 2018: Bahrain
Prepared by Shubhank Suman · Last reviewed
Current
- Legal character
- National law
- Region
- Middle East
What it covers
Bahrain's PDPL provides a comprehensive framework for personal-data processing, including:
- definitions
- processing principles
- personal-data categories
- controller/processor responsibilities
- security
- data-subject rights
- registration
- international transfers
- exemptions
- regulatory oversight
- sanctions.
The official English version defines personal data broadly as information concerning an identified or identifiable individual and includes sensitive personal data such as racial/ethnic origin, political/philosophical opinions, religious beliefs, criminal record, health and sexual status. It also defines processing to include operations performed with or without automated means (Bahrain)
Why it matters
It is Bahrain's principal comprehensive personal-data protection framework.
Its structure is significant because it addresses both:
substantive privacy
and
technical/organisational protection and cross-border governance.
Refer to it when
- Assessing Bahrain personal-data processing
- sensitive-data processing
- controller/processor governance
- security
- international transfers
- data-subject rights
- registration obligations
- DPO/Data Protection Guardian issues
- regulatory oversight.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
High / indirect.
The law is not an AI statute.
Its relevance arises because it expressly regulates processing performed by automated means. Therefore AI systems that process identifiable personal data fall within its general framework.
It is particularly relevant to:
- AI profiling
- biometric systems
- automated analytics
- AI-powered customer systems
- AI systems processing sensitive information.
Cybersecurity
Very High.
Security is a core component of the law and the implementing framework.
Bahrain's data-protection implementation architecture includes technical/organisational security measures, transfer requirements, complaints, notifications and other regulatory decisions.
Applicability
The law applies to covered automated and non-automated processing forming part of or intended to form part of a filing system.
The exact territorial/application rules should be assessed against the statutory scope and applicable implementing decisions rather than assuming every Bahrain-related data flow is automatically covered.
Current validity
CURRENT AND OPERATIVE.
The Bahrain Government continues to publish the law as the governing Personal Data Protection Law. The official English version itself notes that the Arabic text prevails in case of discrepancy (Bahrain)
Read first
Article 1 → processing principles → controller/processor obligations → security → Data Protection Guardian/register → Article 12 → Article 13 → rights/enforcement.
Provisions / sections covered
Article 1: Definitions
Defines:
- personal data
- sensitive personal data
- processing
- controller
- related concepts.
Processing includes collection, recording, organisation, storage, adaptation, retrieval and use, whether automated or (Bahrain)
Processing provisions
The Act establishes requirements concerning lawful processing, purpose, data quality and rights.
Article 10: Register/Data Protection Guardian
The law contains provisions concerning public registers and allows appointment of a Data Protection Guardian; the competent authority may require certain controllers to appoint one. The controller must notify the Authority of such appointment within three working days (Bahrain)
Article 12: Transfers outside Bahrain
The law restricts transfers of personal data outside Bahrain except where specified conditions are met.
These include transfer to countries/territories appearing on an adequacy record compiled by the Authority or case-by-case authorisation where appropriate protection exists (Bahrain)
Article 13: Exceptions to transfer restrictions
Permits specified transfers to locations without adequate protection in prescribed circumstances, including individual consent and other statutory conditions (Bahrain)
Security provisions
The Act contains requirements concerning protection against:
- unauthorised access
- alteration
- destruction
- loss
- disclosure
- unlawful processing.
These provisions are supplemented by Bahrain's implementing regulatory decisions.
FINAL STATUS OF THE FIRST 10
No. Instrument Correct 20 Sept. 2026 status - 1 Argentina Law 25,326 Current / operative
2 Norway Personal Data Act 2018 Current / in force
3 Canada Bill C-27 Historical / proposed / not enacted
4 EU ePrivacy Directive Current / in force
5 Hong Kong PDPO Current
6 Israel Protection of Privacy Law Current / Amendment 13 framework
7 California CPRA Current through CCPA as amended
8 Vietnam Decree 13/2023 Superseded from 1 Jan 2026
9 Qatar Law 13/2016 Current / in application
10 Bahrain Law 30/2018 Current
The two entries that require the strongest status treatment in PrivacyLawHub are therefore Canada #3 and Vietnam #8. For Canada, the official Parliament record shows the proposed C-27 never completed committee consideration before the 44th Parliament ended (Parliament of Canada) For Vietnam, Decree 356/2025 expressly terminates Decree 13/2023 from 1 January 2026 (THƯ VIỆN PHÁP LUẬT)
For your Research Library, these ten should therefore not all receive the same "LAW · CURRENT" badge. The legal character and current validity are substantive metadata, not cosmetic laels.
Continuing with the next 10 entries exactly as they appear in your uploaded document: Nos. 31–40. The uploaded list identifies them as Japan APPI, Australia Privacy and Other Legislation Amendment Act 2024, PIPEDA, China PIPL, California CCPA, Singapore PDPA, California SB 942, Singapore Model AI Governance Framework 2nd Edition, China's Interim Measures for Generative AI Services, and the UAE National Strategy for AI 2031.
I have also distinguished laws, amending Acts, regulations, and policy/framework documents, rather than treating all ten as "statutes."
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Profiling
- Automated decision-making
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Enforcement and penalties
- Registration and notification
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.