Under the Bahrain Personal Data Protection Law (PDPL), which came into effect on August 1, 2019, organizations need to obtain consent from customers in order to collect, process, store and use their personal information for commercial purposes.
Personal data refers to an individual’s smart card number or mobile phone number, along with sensitive personal information such as race, ethnicity, political views, religious beliefs, union affiliation, criminal record or any data related to health matters.
The new law was due to come into force August 1, however, no official announcement was made in advance about the implementation or the setting up of the Personal Data Protection Authority, which will be tasked with regulating the sector and investigating violations.
The PDPL applies to those living and working in Bahrain, local businesses and people who do not reside here but have their data processed from Manama. The law stipulates severe penalties, including criminal liabilities for non-compliance, with up to one year in prison and/or a fine of between BD1,000 and BD20,000.