{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Hassan Radhi & Associates","HASAN SANAD"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","Bahrain"]
["Key Legislation Overview"]
["1. What is the key legislation?","The primary legal framework governing personal data protection in the Kingdom of Bahrain is \nLaw No. (30) of 2018 with Respect to the Personal Data Protection Law (“\nPDPL”). The \nPDPL establishes the rights of individuals (data subjects), the obligations of data controllers and processors, and the oversight power of the Personal Data Protection Authority (“\nPDPA”).\n"]
["2. What are the key decisions applying that legislation?"," The practical implementation of the PDPL is governed by a series of Ministerial Executive Orders by the Ministry of Justice, Islamic Affairs, and Waqf. These include: \n \n Order No. (42) of 2022 regarding the transfer of personal data outside the Kingdom of Bahrain.  \n Order No. (43) of 2022, regarding the conditions to be met in the technical and organizational measures that guarantee the protection of personal data.  \n Order No. (44) of 2022 regarding the rules and procedures for submitting notifications and prior authorization requests to the Personal Data Protection Authority and deciding upon it. \n Order No. (45) of 2022 regarding the rules and procedures for processing sensitive personal data. \n Order No. (46) of 2022 regarding Data Protection Guardians. \n Order No. (47) of 2022 Determining the fees of enrollment and renewal in the Data Protection Guardians register and cases of waiver and refund. \n Order No. (48) of 2022 regarding the Data Subject’s rights. \n Order No. (49) of 2022, With respect to rules and procedures governing submission of complaints regarding violations of the Personal Data Protection Law issued by Law No. (30) of 2018 and deciding upon it. \n Order No. (50) of 2022 Determining the controls and safeguards for protecting the confidentiality of data concerning the instituting and pursuing of criminal proceedings, and related judgments. \n Order No. (51) of 2022, regarding the conditions to be met while creating registers accessible to the public. \n \n These Orders serve as binding legal instruments that provide specificity to the PDPL’s general provisions, enabling compliance and enforcement. "]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?"," Under Article 1 of the PDPL , Personal Data is defined as: \n \n “any information in any form concerning an identified individual, or an individual who can, directly or indirectly, be identified by reference, in particular, to his or her personal identification number, or by reference to one or more factors specific to his or her physical, physiological, intellectual, cultural, economic, or social identity. In determining whether an individual is identifiable, all the means that the data controller or any other person uses or may have access to should be taken into consideration.” \n \n Whereas Sensitive Personal Data is defined as: \n \n “any personal information revealing –directly or indirectly- about an individual’s race, ethnical origin, political or philosophical opinions, religious beliefs, affiliation to a union, personal criminal record, or any information in relation to his health or sexual status.”  \n "]
["2. How is the defined data protected?"," The PDPL sets out a framework for how data is protected, imposing obligations on data controllers and granting rights to individuals. Protection is achieved through the following key mechanisms: \n \n Lawful Processing Requirements Personal Data must be processed fairly, lawfully and for a specific, legitimate purpose. The consent of the data subject is required unless one of the exceptions under Article 4 of the PDPL applies. \n Heightened Safeguard for Sensitive Data Sensitive personal data, such as health, religion, and criminal records, may only be processed with explicit consent or under specific legal conditions as outlined in Article 5 of the PDPL and in Order No. 45 of 2022. \n Secured Processing Data Controllers must implement technical and organizational measures to protect data against unauthorized access, destruction, loss, or alteration, taking into account the nature of the data and risks involved as outlined in Article 8 of Order No. 43 of 2022. \n Data Subject Rights Individuals have enforceable rights, including access, rectification, erasure, objection to processing, and withdrawal of consent (Articles 17–24 of the PDPL and Order No. 48 of 2022 ). \n Breach Notifications Data Controllers must notify the PDPA of data breaches within 72 hours and, in some cases, also inform the affected Data Subjects (Article 4 of Order No. 43 of 2022 ). \n Prior Authorization and DPIA Certain processing activities (e.g., biometric or large-scale sensitive data) require prior authorization from the PDPA and a Data Protection Impact Assessment (“ DPIA ”) to assess and mitigate risks.  \n "]
["3. Who is subject to privacy obligations?"," Under the PDPL , privacy obligations apply broadly to both natural and legal persons who process personal data: \n \n Data Controllers – Any person (individual, company, or entity) who determines the purposes and means of processing personal data, whether by acting alone or jointly with others. \n Data Processors – Are persons (other than the employees of the Data Controller) who process personal data, whether acting alone or jointly with others. Data Processors must comply with contractual and legal safeguards to ensure data security and confidentiality.  \n Data Protection Guardians – Where appointed, the Data Protection Guardians oversee compliance and liaise with the PDPA . They are bound by confidentiality and impartiality duties. \n Scope of Application – The PDPL applies to:\n \n Any natural person resident in Bahrain; \n Any legal person with a place of business in Bahrain;  \n Any person outside Bahrain processing data using means located in Bahrain (unless for transit purposes). \n \n \n "]
["4. How is “data processing” defined?"," Under Article 1 of the PDPL, processing is defined as: \n \n “any operation or set of operations which is performed upon personal data, whether or not by automatic means, including collecting, recording, organizing, classifying into groups, storing, adapting, altering, retrieving, using, disclosing by transmission, dissemination, transference or otherwise making available for others, or combining, blocking, erasing or destructing such data.”  \n "]
["5. What are the principles applicable to personal data processing?"," The PDPL establishes core principles that every Data controller must follow when processing personal data. Under Article (3), these include: \n \n Fairness and Lawfulness – Personal Data must be processed fairly and in accordance with the law. \n Purpose Limitation – Personal Data must be collected for a specific, explicit and legitimate purpose and not processed in ways incompatible with the set purpose (except for statistical, historical, or scientific uses under safeguards). \n Data Minimization – Personal Data must be adequate, relevant and not excessive in relation to the purposes for which it is processed.  \n Accuracy – Personal Data must be correct, accurate, and up to date where relevant \n Storage Limitation – Personal Data must not be kept longer than necessary. If stored for historical, statistical, or scientific purposes, it must be anonymized or encrypted. \n "]
["6. How is the processing of personal data regulated?"," The processing of Personal Data is regulated by the PDPL and a series of Ministerial Orders. The regulation is achieved through a combination of legal conditions, oversight and enforcement: \n \n Lawful Basis – Personal Data cannot be processed without the Data Subject’s consent, unless it is for the purpose of one of the lawful grounds under Article 4 of the PDPL .  \n Sensitive Data Safeguards – Processing of Sensitive Data (health, religion, political opinions, criminal records etc.) is prohibited unless explicit consent is obtained or one of the exceptions in Article 5 of the PDPL . Order No. 43 of 2022 further sets rules for handling such data.  \n Technical & Organizational Measures – Data Controllers should implement appropriate security measures under Article 8 of the PDPL and Order 43 of 2022. \n Prior Notification and Authorization – Certain processing activities (eg, biometric, genetic, or surveillance data) require prior authorization from the PDPA , as per Article 15 of the PDPL and Order No. 44 of 2022.   \n Cross-Border Transfers – Personal Data may only be transferred outside of the Kingdom of Bahrain if the receiving country ensures adequate protection or if prior authorization is obtained (Article 12 and 13 of the PDPL and Order No. 42 of 2022 ). \n Oversight & Enforcement – the PDPA oversees compliance, investigates complaints, and can impose penalties, including fines of up to BD 20,000 and daily penalties for violation. \n "]
["7. How are storage, security and retention of personal data regulated?"," \n Storage & Retention Under Article (3) of the PDPL , Personal Data must not be kept longer than necessary and for the purpose for which it was collected. If it is retained for historical, statistical, or scientific purposes, the Personal Data must be anonymized or encrypted to protect the individual’s identities. For Sensitive Personal Data, Order No. 45 of 2022 restricts retention to the period defined in the data subject’s consent, and the PDPA’s authorization, or other applicable laws. \n Security of Processing The law obliges Data Controllers to implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, destruction, loss, or alteration. These measures should reflect the sensitivity of data, the risks involved, and available technological safeguards.  \n Executive Orders on Security Order No. 43 of 2022 provides technical obligations, requiring controllers to embed ‘privacy by design’ in their systems, regulate access through encryption and password protection, use firewalls and anti-virus software, conduct regular vulnerability assessments and penetration testing, and maintain backup and breach response protocols. Organizations are also required to provide periodic training to ensure that the staff comply with data protection requirements.  \n Breach Notification When Data breaches occur, controllers must notify the PDPA within 72 hours of discovery, unless the breach is unlikely to affect data subjects. If the incident poses a high risk, the affected individuals must also be informed. The notifications must describe the nature of the breach, its consequences, and the measures taken to mitigate the harm.  \n "]
["8. What are the data subjects' rights under the data legislation?","Data Subjects enjoy extensive rights over their Personal Data, including the right to be informed and access to their data (Article 17-18 of the \nPDPL), including the details of why and how the Personal Data is being processed. They may object to processing, particularly for direct marketing or where it may cause harm (Article 20 – 21), and consent to processing may be withdrawn at any time, without any penalties (Article 4-6 of \nOrder No. 48).\nData Subjects also hold the right to rectification, blocking, and erasure of inaccurate or unlawfully processed data, and the right to challenge decisions based solely on automated processing (Article 22 – 23 of the \nPDPL, and Article 4–6 of \nOrder No. 48 of 2022). \nOrder No. 48 of 2022 further reinforces transparency, requiring clear consent procedures and banning “cookie walls” that force consent as conditions of access. \nThese rights are overseen and enforced by the\n PDPA, which has the power to receive complaints, investigate violations, and require Data Controllers to uphold these rights.\n"]
["9. What are the consent requirements for data subjects?","Under the \nPDPL, consent of the Data Subject is paramount. Article (24) stipulates that consent must be given by a Data Subject with full capacity. The consent shall be explicit, clear, and specific to the processing of certain data, and freely given, being informed of the purpose(s) of processing and the consequences of refusal.\nData Subjects also have the right to withdraw consent at any time, free of charge and without liability, and Data Controllers must provide simple procedures to enable such withdrawal (\nOrder No. 48 of 2022, Articles 4-6). \nFor Sensitive Personal Data, processing is prohibited without the Data Subject’s consent unless one of the narrow exceptions in Article 5 of the \nPDPL applies (e.g., legal obligations, medical necessity, public interest). This is reinforced by \nOrder No. 45 of 2022, which requires that sensitive data may only be processed within the scope of the Data Subject’s consent or the \nPDPA’s authorization. \n"]
["10. How is authorization for use of data handled?","Under the \nPDPL, some forms of Personal Data processing are considered so sensitive or high-risk that they cannot be carried out without prior written authorization from the \nPDPA. According to Article 15 of the \nPDPL, these include the automatic processing of sensitive personal data, the use of biometric or genetic data, the linking of Personal Data files between different controllers, and the use of visual recording for surveillance purposes.\nThe detailed procedures for obtaining authorization are set out in \nOrder No. 44 of 2022. A Data Controller wishing to engage in such activities must submit an authorization request using the \nPDPA’s prescribed forms. The request must include the information listed in Article (14)(2) of the \nPDPL, such as the controller’s identity, the purpose of the processing, the categories of data subjects affected, and the security measures in place. The \nPDPA may request clarifications within five working days, and it must issue its decision within thirty days. If no response is given in that timeframe, the request is considered implicitly rejected.\nFor particularly high-risk activities, such as processing biometric data or conducting surveillance through visual recording, the request must also include a \nDPIA. This ensures that the controller has identified and addressed risks to the rights and freedoms of data subjects before the processing begins.\nThe \nPDPA plays a central role in this framework, ensuring that authorizations are granted only where adequate safeguards are demonstrated. It also retains the power to withdraw authorization if conditions are breached, reinforcing its mandate to oversee and enforce compliance with the law.\n"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","Yes. Cross-border data transfers are regulated under \nPDPL and \nOrder No. 42 of 2022. The general principle, set out in Article 12 of the \nPDPL, is that Personal Data may not be transferred outside Bahrain unless the receiving country provides an adequate level of legislative and regulatory protection for such Data. The PDPA maintains and publishes a list of such approved countries.\nIf the destination country is not on this list, Data may only be transferred with prior authorization from the \nPDPA, provided that adequate safeguards are demonstrated. The authorization may be conditional or time-barred. Article 13 of the \nPDPL sets out limited exemptions to this rule, such as where the transfer is necessary for the performance of a contract, to protect the vital interests of the data subject, for compliance with legal obligations or judicial orders, or where the Data Subject has explicitly consented to the transfer.\nOrder No. 42 of 2022 adds detailed conditions, requiring Data Controllers to apply for prior authorization using prescribed forms and to provide details such as the nature of the Data, the purpose and duration of processing, the country of destination, and the safeguards in place. Data Transfers within regional or international corporate groups are permitted if supported by \nBinding Corporate Rules, approved by the \nPDPA. If transfers occur through contracts with external controllers or third parties, the contracts must contain specific clauses ensuring data is used only for agreed purposes, kept no longer than necessary, kept accurate and up to date, and protected by adequate technical and organizational safeguards.\n"]
["12. How are data \"incidents\" and \"breaches\" defined?","The \nPDPL does not provide a stand-alone definition of a “data breach.” Instead, the concept is developed in the implementing \nOrder No. 43 of 2022, which regulates technical and organizational measures for data protection. Under Article 4 of the \nOrder, a “breach or violation” occurs where Personal Data is exposed to unauthorized access, loss, destruction, alteration, or disclosure in a manner that may affect the rights and freedoms of Data Subjects. Data Controllers are required to establish channels for individuals to report potential breaches, document incidents with their causes and consequences, and notify the \nPDPA within 72 hours of discovery unless the breach is unlikely to impact individuals’ rights.\nThe same \nOrder distinguishes between different levels of severity. Where a breach presents a “high risk” to individuals, the \nPDPA may require that data subjects be notified directly. Conversely, if the affected data was encrypted, if corrective measures have removed the risks, or if notification would involve disproportionate effort, controllers may be exempt from notifying individuals and instead issue a public communication.\nIn practice, “incidents” refer to any events affecting the confidentiality, integrity, or availability of Personal Data, while “breaches” are incidents that rise to the level of violating the law or threatening the rights of Data Subjects. \n"]
["13. Are there any notification requirements for incidents and/or data breaches?","Yes, the \nPersonal Data Protection Framework in Bahrain imposes clear breach notification duties on Data Controllers under \nOrder No. 43 of 2022. Article (4)(2) requires Data Controllers to inform the \nPDPA of any data breach or violation within 72 hours of discovery, unless the breach is unlikely to affect the rights of data subjects. If the notification is delayed, the controller must provide justifications.\nData Controllers must also communicate with affected Data Subjects in cases where the breach is likely to result in a “high risk” to their rights and freedoms. However, notification to individuals is not required where the Data was rendered unintelligible (such as by encryption), where subsequent measures eliminated the risk, or where notification would involve disproportionate effort, in which case a public communication may suffice.\n\nThe notifications must be substantive. The notification to the \nPDAP should include details such as the type of breach, categories and numbers of affected Data Subjects, the likely consequences, and the measures taken to address and prevent recurrence. To the Data Subjects, the controller must at least specify the type of breach, the data concerned, and recommendations to mitigate its effects.\n"]
["14. Who is/are the privacy regulator(s)?","The primary privacy regulator responsible for the enforcement and oversight of Personal Data protection in the Kingdom of Bahrain is the Ministry of Justice, Islamic Affairs, and Waqf, acting as \nPDPA. This designation was formalized by \nResolution No. 78 of 2019, which assigned the duties and powers of the \nPDPA to the Ministry of Justice, Islamic Affairs, and Waqf. \n"]
["15. What are the consequences of a data breach?","Under \nOrder No. 43 of 2022, Data Controllers must notify the \nPDPA within 72 hours of discovering a breach, unless it is unlikely to affect individuals’ rights. In cases of high risk, data subjects themselves must also be notified. The failure to comply with these duties exposes the Data Controller to investigation and penalties.\nIf the \nPDPA finds a violation, it may order the controller to suspend the violating conduct, withdraw authorizations, or impose daily penalties of up to BD 2,000 and administrative fines up to BD 20,000.\nIn more severe cases, breaches may also trigger criminal liability. Under Article (58) of the \nPDPL, unlawful processing, failure to notify the PDPA, or obstructing investigations may result in imprisonment of up to one year and/or fines between BD 1,000 and BD 20,000. Where the breach is committed by a company, the fines may be doubled under Article 59 of the \nPDPL.\nBeyond fines and sanctions, the \nPDPA may also publish the names of violators, damaging their reputation, and affected individuals have the right to claim compensation for harm suffered.\n"]
["16. How is electronic marketing regulated?","Electronic marketing in Bahrain is regulated under \nPLPD and treats it as a form of Personal Data processing. The \nPDPL requires that individuals be informed in advance if their Personal data will be used for direct marketing purposes and grants them the right to object at any time, free of charge (Articles 19–20).\nProcessing for electronic marketing must therefore be based on the data subject’s consent or another lawful ground under the \nPDPL. Data Subject’s Consent should be explicit, freely given, and easily withdrawn. The implementing \nOrder No. 48 of 2022 reinforces this by prohibiting practices such as “cookie walls” that make access to online services conditional on consent.\n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?","Yes, while the \nPDPL provides the general framework governing Personal Data protection in Bahrain, there are additional sector-specific and industry-specific privacy requirements that may apply in certain regulated sectors. These requirements operate alongside the \nPDPL and must be observed to the extent they do not conflict with the \nPDPL or its implementing regulations.\nIn particular, the Central Bank of Bahrain (“\nCBB”) imposes strict Data confidentiality and cybersecurity requirements on its licensees, including banks and insurance companies, through regulations in the relevant rulebooks, circulars, and guidance. Furthermore, \nOrder No. 50 of 2022, sets out special requirements for the processing of personal data related to criminal proceedings, ensuring such data is protected from disclosure except as permitted by law, and \nOrder No. 51 of 2022 establishes requirements for creating and managing public registries, including the need for data subject consent and mechanisms for data subjects to amend or delete their information. \n"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?","The \nPDPL establishes the role of the Data Protection Guardian (the equivalent of a Data Protection Officer). Under Article 10 of the \nPDPL, a Data Protection Guardian assists the controller in complying with the law, acts as liaison with the Authority, monitors processing activities, keeps the required registers, and reports violations to the Authority if they are not corrected within ten days. The Guardian must perform duties independently and impartially.\nThe appointment of a Data Protection Guardian is optional for Data Controllers, unless the \nPDPA’s Board decides that certain categories of Data Controllers must designate one.\nOn 24 March 2025, the CBB issued a directive to all its licensees informing that financial sector entities that are considered Data Controllers must appoint a Data Protection Guardian.\nIn all cases, any appointment must be notified to the \nPDPA within three working days.\n\nThe implementing \nOrder No. 46 of 2022 regulates accreditation and registration. It distinguishes between Internal Guardians (employees of the controller) and External Guardians (natural or legal persons engaged externally). Both must be enrolled in the \nPDPA’s Data Protection Guardians Register. Internal Guardians must be permanent residents in Bahrain and employed by the controller or within its group, while External Guardians must meet qualifications such as a degree or certification in IT, information security, audit, or related fields, or have at least two years of relevant experience. Legal persons acting as External Guardians must employ at least three qualified staff in the observance of their role, while all Data Protection Guardians must be of good conduct and free of disqualifying convictions.\n"]
["19.\tWhat are the record-keeping and documentation obligations?","The \nPDPA requires Data Controllers to maintain documentation that demonstrates compliance. Under Article 10, a Data Protection Guardian should keep a register of processing operations subject to notification to the \nPDPA. This register must include at least the details required under Article 14, such as the controller’s identity, the purpose of processing, categories of data and recipients, cross-border transfers, and a description of security measures.\nData Controllers must also notify the \nPDPA of any changes to the information supplied within 30 days, and these notifications are recorded in the official Notifications and Authorizations Register maintained by the Authority under Article 16.\nFurthermore, \nOrder No. 43 of 2022 requires Data Controllers to document technical and organizational measures, data breach procedures, and results of Data Protection Impact Assessments (\"\nDPIAs\") where applicable. Whereas \nOrder No. 46 of 2022 further mandates that Data Protection Guardians maintain updated registers, disclose conflicts of interest, and retain supporting records for Authority inspections.\n"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?"," Under Article (3) of Order No. 43 of 2022 , a DPIA is required before engaging in high-risk processing activities. \n These include: \n \n large-scale or systematic automated processing (including profiling); \n large-scale processing of sensitive or criminal data; and \n systematic monitoring of publicly accessible areas. \n \n The DPIA must include a description of the processing operations, their purposes, an assessment of necessity and proportionality, identification of risks to the rights and freedoms of data subjects, and the safeguards proposed to address those risks. \n For specific categories of processing, such as biometric data or visual surveillance, the DPIA must also be submitted with the prior authorization request to the PDPA , as expressly required under Order No. 44 of 2022 , Article 6. "]
["21.\tWhat are the requirements for third-party vendor management and data sharing?","Under Article 8 of \nPDPA, Data Controllers must select processors that provide sufficient safeguards and must ensure processing is governed by a written instrument. That instrument should oblige the processor to act only on the Data Controller’s instructions and to apply equivalent security and confidentiality obligations. \nData Controllers remain responsible for compliance, even when outsourcing, and must ensure processors cannot use the Data for their own purposes. Article 9 reinforces confidentiality by prohibiting disclosure or processing outside lawful grounds, both during and after the contractual relationship.\nWhen personal data is shared with other controllers or transferred abroad, the rules on notification, prior authorization, and cross-border transfers apply. Articles 12-15 of the \nPDPL and \nOrder No. 42 of 2022 require either adequacy, safeguards approved by the Authority, or explicit consent from the data subject.\nExecutive Order No. 43 of 2022 also obliges controllers to document security measures, vendor due diligence, and safeguards when relying on third parties for processing.\n"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?","Enforcement of Bahrain’s rests with the \nPDPA, which has powers to investigate, inspect, and sanction Data Controllers and Data Processors, where violations are proven, the \nPDPA may order the cessation of unlawful processing, withdraw prior authorizations, publish statements of violations, and impose administrative fines of up to BD 20,000 or daily penalties of up to BD 2,000 to compel compliance.\nThe \nPDPL also provides subjects non-compliance to criminal liability. The unlawful processing, failure to notify or obtain authorization, or obstructing investigations may result in imprisonment of up to one year and/or fines between BD 1,000 and BD 20,000, doubled where committed by legal persons. Misuse of the Authority’s logo carries lighter penalties of up to one month’s imprisonment or fines up to BD 500.\nIn addition, affected individuals have the right to claim compensation for damage caused by unlawful processing.\n"]
["23.\tWhat are the ongoing compliance and audit requirements?","The \nPDPL imposes continuing duties on controllers to ensure compliance is not a one-off exercise but an ongoing obligation. Data Controllers must maintain accurate and up-to-date processing registers (kept either by the Data Protection Guardian or the controller directly) and notify the \nPDPA of any changes within 30 days.\nData Controllers are required to implement and regularly review technical and organizational measures to safeguard Personal Data. \nOrder No. 43 of 2022 obliges periodic assessments of security controls, including vulnerability testing, breach response readiness, and staff training, with documentation retained for \nPDPA inspection.\nWhere high-risk processing is involved, Data Controllers must conduct and keep records of \nDPIA before processing begins, and submit them with authorization requests where required.\nThe \nPDPA has powers to conduct inspections and investigations to verify ongoing compliance, and controllers must make documentation, contracts, and registers available upon request. Data Protection Guardians, where appointed, must operate independently and impartially, maintain compliance registers, and report unremedied violations to the Authority.\n"]
["24. Are there any recent developments or expected reforms?","As of the date of this questionnaire, there are no amendments to the \nPDPL or its Executive Orders. \nThe Executive Orders implementing key aspects such as transfers, data subject rights, security,\n DPIAs, guardianship, and breach notification, remain the most significant updates to date.\nWhile there’s no confirmed pending legislation, Bahrain is in the process of developing legislation on Artificial Intelligence (“\nAI”). While still at a policy stage, it is anticipated that such a law could introduce new rules or lead to amendments to the existing data protection framework, particularly in areas such as automated decision-making, profiling, and data governance.\n"]