Bahrain: what the rules require

The policy must identify the controller, the purposes and description of processing, recipients or disclosures, retention, and data subject rights, and be available before or at the time data is collected.

Basis: Saudi PDPL Article 12 (privacy policy before collection); DIFC Law Articles 29 and 30; Oman Executive Regulations (notice before processing, including DPO details); Qatar PDPPL (notice before processing); ADGM and UAE PDPL transparency duties.

How to meet it: Open the policy with the legal name and contact details of the controller, then list purposes, data categories, recipients, retention periods and rights. For Saudi users publish it in Arabic and English and make it available before any data is collected.

The policy must state the lawful basis relied on for each processing purpose, such as consent, contract, legal obligation or, where available, legitimate interests.

Basis: DIFC Law Article 29 requires notices to state the lawful basis; UAE PDPL Articles 4 to 6 set consent plus listed exceptions with no general legitimate interests basis; Saudi PDPL Article 5 makes consent the default basis unless an exception applies.

How to meet it: Add a table mapping each purpose to its lawful basis. Do not cite legitimate interests for onshore UAE, Saudi or Oman processing unless the law expressly allows that ground.

Where consent is used, the policy must tell people they can withdraw consent at any time, explain how, and state that withdrawal does not affect earlier lawful processing.

Basis: Saudi PDPL Article 5(2); DIFC Law Articles 12(5) and 32; UAE PDPL consent provisions; Bahrain Resolution No. 48 of 2022 (withdrawal at any time without cost); Qatar PDPPL (right to withdraw approval); Oman PDPL (right to revoke consent).

How to meet it: Add a sentence such as: You can withdraw your consent at any time, free of charge, by [method]; this does not affect processing carried out before withdrawal. Set up an internal procedure to act on requests.

The policy must explain that individuals can request access to, or a copy or summary of, their personal data and how it is processed, and how to submit that request.

Basis: DPDP Act Section 11; UAE PDPL Articles 13 to 18; DIFC Law Article 33(1) (free, within one month); Saudi PDPL Article 4; Qatar PDPPL (right to review); Oman PDPL (right to obtain a copy); ADGM and Bahrain PDPL access rights.

How to meet it: List access as a named right with the request channel, identity checks and expected response time, for example one month in DIFC and 30 days under Qatar guidelines.

The policy must explain how individuals can ask for inaccurate data to be corrected or updated and for data to be erased, and when erasure may be refused.

Basis: DPDP Act Section 12; DIFC Law Article 33(2); Saudi PDPL Article 4; UAE PDPL Articles 13 to 18; Qatar PDPPL (alter or delete); Oman PDPL (rectify, update, erase, block); ADGM rights to correction and deletion.

How to meet it: Add named sections for correction and erasure, the request method, and the legal grounds for refusing erasure (for example legal retention duties).

The policy must explain the right to object to certain processing and, where available, to restrict processing, and how to exercise it.

Basis: DIFC Law Articles 34 and 35; UAE PDPL Articles 13 to 18 (restriction and objection); ADGM rights to restrict and object; Qatar PDPPL (objection to unnecessary or discriminatory processing); Bahrain PDPL (right to object in certain circumstances).

How to meet it: Add a short section on objecting and restricting processing, including an unconditional right to object to direct marketing where applicable.

The policy must state how long each category of data is kept, or the criteria used, and that data is deleted or anonymised once no longer needed.

Basis: Saudi PDPL Article 18 (destroy data when no longer necessary); DIFC Law Article 22 (delete, anonymise or archive when the basis ends); Oman PDPL fines retention violations; UAE PDPL, ADGM, Qatar and Bahrain storage limitation duties.

How to meet it: Add a retention table by data category with periods or criteria, plus the method of secure deletion or anonymisation at the end of the period.

The policy must describe the technical and organisational measures used to protect personal data, such as encryption, access control, logging, backups and staff confidentiality.

Basis: DPDP Act Section 8(5) and Rule 6; Saudi PDPL Article 19; Qatar PDPPL Article 13 (cited by NCSA in Binding Decision No. 3 of 2025); DIFC, ADGM, UAE, Bahrain and Oman security obligations.

How to meet it: Add a security section naming the main controls (encryption in transit and at rest, role-based access, logging and monitoring, backups, staff training). Avoid absolute promises such as 100 percent secure.

The policy must commit to notifying the regulator within 72 hours of becoming aware of a qualifying breach (ADGM Commissioner, SDAIA, Qatar NCSA, Bahrain PDPA or Oman MTCIT) and to informing affected individuals.

Basis: ADGM Data Protection Regulations 2021; Saudi PDPL Article 20 and Implementing Regulations (via the National Data Governance Platform); Qatar regulator guidelines and PDPPL Article 14; Bahrain Resolution No. 43 of 2022; Oman Executive Regulations (individuals also within 72 hours where severe harm is likely).

How to meet it: Add a breach clause with a 72-hour regulator deadline, the named regulator for each country, reasons for any delay and notice to affected individuals. For Oman, also tell individuals within 72 hours when severe damage is likely.

The policy must disclose transfers outside Bahrain and confirm that they go only to whitelisted countries or under a PDPA permit.

Basis: Bahrain PDPL Articles 12 and 13 (breach is a criminal offence) and Resolution No. 42 of 2022 (whitelist of 83 countries; PDPA permit for others, including intra-group transfers).

How to meet it: List destination countries, state that they are on the PDPA whitelist or covered by a PDPA permit, and record the permit reference where used.

The policy must state that processors and vendors handle personal data only under a binding written contract covering instructions, security, confidentiality, sub-processing and deletion or return.

Basis: DPDP Act Section 8(2) (processors only under a valid contract); UAE PDPL Article 8; DIFC Law Article 24 (written agreement, prior authorisation for sub-processors); ADGM written contract duty; Bahrain PDPL Article 8.

How to meet it: Add a vendors section describing the categories of processors used, the written data processing agreements in place, sub-processor approval and that vendors must notify you of breaches without undue delay.

If a data protection officer is appointed, the policy must name them and the business must ensure they meet the PDPA qualification rules and are approved by the PDPA.

Basis: Bahrain Resolution No. 46 of 2022 (qualifications for internal and external officers, PDPA decision within 30 days) and No. 47 of 2022 (fees).

How to meet it: Name the appointed officer in the policy, and keep evidence of qualifications, PDPA approval and any conflicts of interest disclosure.

The policy must explain which cookies and trackers are used, their purposes and providers, and how users accept, refuse or withdraw consent for non-essential ones.

Basis: No dedicated cookie law was verified in these jurisdictions (DLA Piper confirms none in Saudi Arabia), so general notice and consent rules apply; Bahrain Resolution No. 48 of 2022 says consent required as a condition of browsing is invalid, and DPDP Section 9(3) bans tracking of children.

How to meet it: Add a cookie section or separate cookie policy listing cookies by category, purpose, provider and duration, with a banner that lets users refuse non-essential cookies as easily as they accept them.

The policy must identify any sensitive data processed, such as health, biometric, genetic, religious, ethnic, criminal or (in Saudi Arabia) credit and location data, and the extra conditions and safeguards applied.

Basis: DIFC Law Article 11; UAE PDPL sensitive data rules; Saudi PDPL Articles 23 and 24 (health and credit data controls) and Article 26 (no marketing use of sensitive data); ADGM policy document duty; Bahrain PDPL Article 5; Qatar and Oman special data rules.

How to meet it: List each sensitive category processed with its purpose, legal condition (often explicit consent) and extra safeguards such as restricted access.

Where sensitive or restricted data is processed, the policy must state that the required regulator permit or prior approval has been obtained.

Basis: Qatar PDPPL (special nature data needs regulator authorisation); Bahrain Resolution No. 44 of 2022 under PDPL Article 15 (biometrics, non-medical genetics, linking data sets, surveillance recording); Oman Executive Regulations (MTCIT permit, 45-day decision, valid five years).

How to meet it: Record the permit or approval reference and validity date for each restricted activity, and state in the policy that such processing happens only under regulator approval.

The compliance policy must confirm that processing has been registered or notified to the regulator (DIFC or ADGM Commissioner, or Bahrain PDPA) and that the filing is kept current or renewed annually with any fee paid.

Basis: DIFC Law Article 14(7) (register by filing a notification of processing operations and keep it current; failure to renew is the most common fine); ADGM Regulations (annual notification and data protection fee); Bahrain PDPL Article 14 (notify the Authority before processing).

How to meet it: Record the notification reference and renewal date, and assign an owner to renew it each year and update it when processing changes.