Bahrain PDPL Compliance Guide
Everything you need to know about Bahrain's Personal Data Protection Law — the GCC's second data protection law, and the one that voids cookie-wall consent outright.
Aug 2019
In Force Since
BD 40,000
Maximum Corporate Fine
All Sectors
Applies To
Overview
Law No. 30 of 2018 with Respect to Personal Data Protection came into force on 1 August 2019, making Bahrain the second GCC state to enact national privacy legislation after Qatar. It is enforced by the Personal Data Protection Authority under the Ministry of Justice, Islamic Affairs and Waqf, which published supplementary guidelines in 2022. Two features set it apart for anyone running a website. Consent, where relied upon, must be express and given in writing or by electronic means — not inferred from continued browsing. And consent is void where a cookie banner obliges the visitor to accept before they can browse at all, which makes the cookie wall an invalid pattern in Bahrain rather than merely a discouraged one. The law also carries a criminal track, which is unusual in the region.
Key Requirements
Express, Recorded Consent
Where you rely on consent, it must be express and captured in writing or electronically. Implied consent from continued use of the site does not satisfy the law.
No Cookie Walls
Consent is void if the banner requires the visitor to accept before browsing. Access to the site cannot be conditioned on accepting non-essential cookies.
Easy Withdrawal
Data subjects may withdraw consent at any time through easy procedures. Withdrawal must be as straightforward as giving consent was.
Data Subject Rights
Provide access, correction, objection and erasure rights, and respond within the periods the law sets.
Notification and Registration Duties
Certain processing activities require prior notification to or authorisation from the Authority. Check whether yours fall inside that set before you begin.
Security and Processor Contracts
Apply appropriate technical and organisational safeguards, and bind processors contractually to equivalent obligations.
Penalties for Non-Compliance
Bahrain's PDPL carries both administrative fines and a criminal track — unusual among Gulf privacy laws.
Criminal Penalties
A natural person violating the law faces imprisonment of up to one year, a fine of BD 1,000 to BD 20,000, or both.
Doubled for Companies
Where a legal person commits the offence, the fine may be doubled — a ceiling of roughly BD 40,000.
Administrative Fines
The Authority can impose one-off fines up to BD 20,000, or daily penalties up to BD 1,000, increasing for repeat offences.
Publication and Referral
The Authority may publish statements about established violations and refer suspected crimes to the Public Prosecutor.
How Arqam360 Helps
No Wall, By Design
Reject is presented as prominently as accept, and the visitor can browse without choosing. The pattern Bahrain voids is not one our banner can produce.
Express Consent, Recorded
Every acceptance is an explicit action, stored with a timestamp and the exact categories chosen — the electronic record the law asks for.
Withdrawal in One Click
A persistent preference centre lets visitors change or withdraw consent at any time, which is what the easy-procedures requirement means in practice.
Bilingual and Native
Arabic and English consent written natively rather than translated, with a right-to-left layout designed rather than mirrored.
Enforcement Timeline
PDPL Issued
Law No. 30 of 2018 with Respect to Personal Data Protection is issued — the second national privacy law in the GCC.
Law Enters Into Force
The PDPL takes effect on 1 August 2019, with the Personal Data Protection Authority responsible for supervision and enforcement.
Guidelines Published
The Authority issues supplementary guidelines clarifying consent, notification duties and the treatment of website cookie banners.
Check Your Bahrain PDPL Compliance
Scan your storefront free. See whether your banner forces consent before browsing, and which trackers fire before the visitor chooses.
Run a Free ScanLast updated:
Sources
- 1.Law No. 30 of 2018 with respect to Personal Data Protection — official English text (Kingdom of Bahrain)
- 2.DLA Piper, Data Protection Laws of the World — Bahrain
- 3.Cooperation Council for the Arab States of the Gulf — official portal
- 4.Albesher, Alsaad & Alhussain (2026) — cookie consent usability and privacy compliance in Saudi Arabia, PeerJ Computer Science 12:e3701
Regulations
Compliance guides for GDPR, PDPL, and moreSaudi PDPL Compliance Guide
UAE PDPA Compliance Guide
Qatar PDPPL Compliance Guide
Jordan PDPL Compliance Guide
Kuwait Data Protection Compliance Guide
GCC Privacy Laws Overview
GDPR Compliance Guide
CCPA Compliance Guide
Bahrain PDPL FAQ
Common questions about Bahrain's Personal Data Protection Law.
Law No. 30 of 2018 came into force on 1 August 2019. Bahrain was the second GCC state to pass national privacy legislation, after Qatar in 2016.
Get Bahrain PDPL Compliant
Deploy a bilingual banner with no cookie wall, express consent and a recorded audit trail. Free forever on one domain.