What are the fines under Bahrain's PDPL?

For the offences the law lists, an individual faces up to one year in prison, a fine of BD 1,000 to BD 20,000, or both (Article 58). Where the offence is committed in a company's name or for its benefit, the fine limits double to BD 2,000 to BD 40,000 (Article 59).

The listed offences include unlawful processing of sensitive data, unlawful transfers abroad, and processing without notifying the Authority or obtaining its authorisation.

Separately, if a business ignores an order to stop a violation, the Personal Data Protection Authority can impose a fine of up to BD 20,000, or a daily penalty of up to BD 1,000, rising to BD 2,000 a day for a repeat within three years (Article 55).