Bahrain PDPL and AI: transfers, authorisation and prior notice for automated processing

Bahrain’s Personal Data Protection Law, قانون حماية البيانات الشخصية, is Law No. 30 of 2018, and it has been in force since 1 August 2019 [1, 10]. It never mentions artificial intelligence, and it does not need to. Article 2 applies it to any processing by wholly or partly automatic means, and Article 14 makes the controller tell the regulator before that kind of processing starts [1]. An AI system is automatic processing from its first call to a model.

The Law applies to any individual habitually resident in Bahrain and anyone with a place of business there who processes personal data, and to anyone else who processes data using means situated in the Kingdom other than for transit; a company in that last group must appoint a representative in Bahrain and tell the Authority [1]. On its text the hook is where the controller is or where its equipment sits, not where the people in the data live. That is a narrower reach than Saudi Arabia’s law, which also covers companies abroad processing data about people in the Kingdom, as the duty-by-duty reading of the Saudi PDPL sets out. Public-security processing by the security bodies is excluded, but the Law defines a person to include any public entity, so ministries and government-owned companies are controllers like everyone else [1].

The regulator is the Personal Data Protection Authority (PDPA). Under Decree No. 78 of 2019 the Ministry of Justice, Islamic Affairs and Waqf performs its duties, with the Minister acting as its board and the Undersecretary as its chief executive until the Authority has a board of its own [11]. Most of the detail an AI team needs sits in orders the Minister issued on 17 March 2022 [2, 4, 5, 6, 7, 8, 9].

The filing duties carry criminal penalties. Processing without the Article 14 notice, failing to notify a change, processing without an Article 15 authorisation and transferring data in breach of Articles 12 and 13 are all offences under Article 58, punishable by up to a year in prison, a fine of 1,000 to 20,000 Bahraini dinars, or both [1]. Article 59 doubles the fine limits for a company where the offence results from the conduct or gross negligence of its board or a delegated official. Where a controller ignores an order to stop a violation, the Authority can also impose a daily penalty of up to 1,000 dinars (2,000 for a repeat within three years), an administrative penalty of up to 20,000 dinars, or withdraw an authorisation, and anyone harmed can claim compensation [1].

Here is the Law and its orders read the way an AI team has to read them. The first column is where each duty sits. The second is my reading of when an AI system triggers it. The third is what you file or keep, which is what the Authority or an inspector will ask to see.

The first column is from the Law [1] and the orders [2, 4, 5, 7]. The middle column is my reading, not the Authority’s, and this page is not legal advice.

This is the duty that catches teams out, because it bites before the system exists. Article 14 requires the controller to give the Authority prior notice of any wholly or partially automated processing operation, or set of operations, serving one purpose or several related ones [1]. The notice names the controller and any processor, the purpose, the data, the categories of people and recipients, any proposed transfer outside the Kingdom, and enough about security for the Authority to make a preliminary assessment, and it goes in on the Authority’s own form [1, 5, 12].

The Authority has ten working days to ask for anything missing, the controller then has up to fifteen days to supply it, and processing stops until the notification is complete [1, 5]. A change to anything notified goes to the Authority within thirty days [1, 5]. On my reading, a new model provider or a new country receiving the data is exactly that kind of change. Notification does not replace consent where the Law requires consent [5].

Four cases need no notice: a register kept by law to inform the public, processing by associations, unions and non-profit bodies, an employer’s processing of its employees’ data as far as necessary, and any controller that has appointed a Data Protection Guardian [1]. The employee exemption is narrower than it looks for AI. It covers employees, so on my reading a model that screens job applicants sits outside it.

The guardian route is the one I would look at first for any organisation planning more than one AI use case. A guardian keeps the register of the processing the controller would otherwise notify and sends the Authority an updated version every month [1]. Guardians must be enrolled in the Authority’s register: internal guardians are employees of the controller or its group with permanent residence in Bahrain, and external guardians are qualified individuals or licensed firms with at least three qualifying staff. Enrolment lasts a year, and the controller tells the Authority of an appointment within three working days [1, 6]. That swaps a filing per use case for a register that has to stay current, which suits a team shipping changes every month.

Article 15 prohibits five kinds of processing without the Authority’s prior written authorisation: automatic processing of sensitive data where the person is legally unable to consent, automatic processing of biometric data to verify identity, automatic processing of genetic data outside licensed medical care, automatic processing that links the personal data files of two or more controllers processed for different purposes, and visual recording used for surveillance [1]. Appointing a guardian does not lift any of them.

Three of the five map straight onto common AI projects. Face matching at onboarding is biometric processing to verify identity. Video analytics on camera feeds is visual recording used for surveillance. Enriching your customer data with a partner’s dataset to train or run a scoring model is, on my reading, linkage between two controllers’ files held for different purposes. None of these is unusual in a bank, a telecoms operator or a government service.

The request carries the same information as a notification [1, 5]. For biometric and camera uses it must also come with a data protection impact assessment and a statement on transparency, proportionality, who can reach the images, videos and biometric data, and how people can see recordings of themselves [5]. The Authority decides within thirty days of submission, and no answer in that time counts as a refusal [1, 5]. Put those thirty days in the project plan before anyone books a launch date.

Article 12 prohibits transferring personal data outside Bahrain except to a country or territory on a record the Authority compiles, or with the Authority’s authorisation case by case where the data will have adequate protection [1]. Ministry of Justice Order No. 42 of 2022, issued on 17 March 2022, carries that record: 83 countries and territories, including the United Arab Emirates, Saudi Arabia, Kuwait, Oman, Jordan, Egypt, India, the United Kingdom and the United States [2, 3]. Qatar is not on it, in the English text or in the Arabic text published in the Official Gazette [2, 3]. Check the record itself rather than a summary of it. The Authority’s list of its orders, read on 30 September 2026, shows no later order replacing it [9].

For a country off the record, Order No. 42 sets the route. The controller asks for prior authorisation on the Authority’s form, giving the controller and processor, the data, the purpose and duration, the origin and destination with the protections there, the relevant agreements and laws, and a statement on whether protection will be adequate [2]. A transfer within a group to an unlisted country needs the same authorisation, and the group’s binding corporate rules apply where it has them. A transfer under contract to a controller or third party in an unlisted country needs the authorisation and a copy of the contract, which must keep processing to its stated purposes, limit retention, keep the data accurate, apply technical and organisational measures, inform the people concerned and let them see, correct, block or erase their data [2]. The authorisation can be conditional or time-limited [1, 2].

Article 13 allows a transfer to a country without adequate protection in listed cases, including the person’s consent, necessity for a contract with them or in their interest, their vital interests, a legal obligation and legal claims [1]. Consent under the Law has to be written, explicit, clear and specific to the processing [1], which is hard to collect for every prompt a support assistant sends.

For an AI team the practical result is a country list, not a vendor list. The UAE, Saudi Arabia, the UK and the US are on the record, so a model endpoint in any of them needs no authorisation, although the transfer still belongs in the Article 14 notification [1, 2]. Google Cloud’s Doha region, me-central1, is in Qatar, while its Dammam region, me-central2, is in Saudi Arabia [13]: the first needs an authorisation or an exemption for Bahraini personal data and the second does not. A cloud region in Bahrain does not settle the question either, because a region can host the platform while the model runs somewhere else, which is the gap between a live region in the country and a model running in it. Ask each provider for every country that can receive a prompt, a log or a support ticket, and check each one against the record.

Article 22 gives a person the right to ask for a decision to be taken again in a way that is not solely automated, where it is based solely on automated processing of their data and assesses their performance at work, financial standing, creditworthiness, reliability or conduct [1]. The reconsideration is obligatory and free. It does not apply where the decision is taken in entering into or performing a contract with the person and suitable safeguards, such as hearing their view, are in place [1].

Order No. 48 of 2022 turns that into two things to build: telling the person about the automated decision, and an electronic or similar procedure for raising an objection, deciding it and telling them the outcome within a reasonable period [7]. Article 18 adds that when data is the sole basis for a decision directly affecting someone, a request for their data must be answered with how it is used, in terms an average person can follow [1].

Order No. 43 of 2022 then makes a data protection impact assessment compulsory in the Article 22 cases, for systematic and extensive evaluation based on automated processing, including profiling, that produces legal or similarly significant effects, for large-scale processing of sensitive or criminal data, and for systematic monitoring of a public area on a large scale [4]. The assessment needs at least a systematic description of the processing and its purposes, a necessity and proportionality test, the risks to people’s rights and the measures to address them, and the controller takes the guardian’s advice where there is one [4]. A credit model, a fraud score that blocks payments or an HR model that flags staff will usually meet one of the first two triggers. Before writing any of these, rank your AI use cases by risk so the assessments go where they matter.

One more line matters for training data. Order No. 45 of 2022 keeps sensitive data to the scope of the consent or authorisation it is processed under, and rules out any other purpose [8]. On my reading, health records collected for care cannot be reused to train a model on the strength of the original purpose alone, so settle the basis with counsel first.

This is the order I would run for each AI use case, from idea to launch. It is built from the Law and the orders, not a process the Authority publishes.

It moves quickly when the data owner can make decisions and the authorisations are started early. When nobody can say which systems hold personal data, the map is the project.

The work on this page is what we sell as AI governance implementation: the endpoint map, the transfer checks, the impact assessments and the decision logs built into the system they describe, so the notification or the guardian’s register is drawn from the system rather than written beside it. We work with clients across the UK, the US and the Gulf, and we have built Arabic-language AI, including bilingual Arabic and English search and Arabic document OCR, which matters in Bahrain because much of the personal data an AI system reads there is in Arabic.

Our closest published work in the region is the production estate of a government-accredited EdTech in the Middle East, whose database we replatformed into Google Cloud’s Doha region, me-central1, to meet Gulf data-residency requirements. For a Bahraini controller that same region is in Qatar and off the transfer record, which is exactly the kind of fact the endpoint map exists to catch. Once a scope is signed, a fixed-scope build can start within a day, and if you already have a scoped job, we can resource it on contract from the collective of associates who work with us, held to the same standard. The filings with the Authority and the legal view stay with your guardian and your counsel. The call is booked from the end of this page.