My company works in Bahrain. What does the law ask of us when an AI agent reads our data?
The short answer
The Personal Data Protection Law, Law No. 30 of 2018, applies. Consent is the default basis, with a short list of exceptions that includes your legitimate interests. You may send data directly to the countries on the official list, which includes the United States, and elsewhere only with a permit or on the grounds the law lists. A breach must be reported to the Authority within 72 hours, and a person may ask that certain decisions about them not rest on automated processing alone.
The law that applies
The Personal Data Protection Law was issued by Law No. 30 of 2018 on 12 July 2018. It came into force from the first day of the month after one year had passed since its publication in the Official Gazette. It covers people who normally live in Bahrain or have a place of business there, and companies with a place of business there. It also covers anyone outside Bahrain who processes data using means located in Bahrain, unless those means only carry the data through Bahrain. A company that processes data this way must appoint an authorized representative in Bahrain.
The law created the Personal Data Protection Authority. Decree No. 78 of 2019 gave the Authority’s powers to the Ministry of Justice, Islamic Affairs and Waqf until the Authority has its own budget and a decree forms its board. In March 2022 the Minister issued ten resolutions to implement the law.
Can the agent read personal data at all?
The law forbids processing personal data without consent, unless the processing is necessary for one of these:
- performing a contract the person is party to, or steps the person asked for before a contract.
- a legal obligation, or an order of a court or the Public Prosecution.
- protecting the person’s vital interests.
- the legitimate interests of your company or of a third party the data is disclosed to, unless this conflicts with the person’s fundamental rights and freedoms.
Consent counts only if it is written, explicit, clear and specific to the processing. The person may withdraw it at any time. Sensitive data includes ethnic origin, political or philosophical opinions, religious beliefs, union membership, criminal records, and data on health or sexual status. It needs consent unless one of the law’s narrower exceptions applies, such as obligations under an employment relationship.
Decisions made by machine
Where a decision is based only on automated processing that assesses a person’s work performance, financial standing, creditworthiness, conduct or trustworthiness, the person may ask for another method that does not rely only on automated processing. You must agree, at no charge. This does not apply where the decision is made in concluding or performing a contract with the person, provided you take all measures that protect their rights, including a chance to give their view.
A 2022 resolution requires an impact assessment for this kind of automated processing, and for profiling that leads to decisions with legal effects on a person or that affect them significantly.
Before you start
- Notify the Authority. You must notify the Authority before you start processing that is wholly or partly automated. Processing of your own employees’ data within what the job requires is exempt, and so is a company that has appointed a data protection guardian.
- A prior permit for some processing. Some processing needs the Authority’s prior written permit. Two cases touch agents: automated processing of biometric data used to identify people, and automated processing that links personal data files held by two or more companies for different purposes.
The model provider, and data sent abroad
When the agent sends text to a model run by a provider, the provider processes the data on your behalf. You must choose a provider that gives enough guarantees on technical and organizational measures. You must have a written contract that says the provider processes data only on your instructions and carries the same security and confidentiality duties as you.
The law forbids transfers outside Bahrain except in the cases it sets. Resolution No. 42 of 2022 explains them:
- Countries on the list. You may transfer data directly to the countries and territories listed in the resolution’s annex. The list includes the United States, the United Kingdom and Ireland.
- Other countries. You need a permit from the Authority for each case. A transfer under a contract also needs a permit, and the contract must carry the safeguards the resolution lists.
- Exceptions in the law. Transfers are also allowed in some cases, such as the person’s consent, or where the transfer is necessary to perform a contract with the person.
When something goes wrong
A 2022 resolution requires you to set procedures to notify the Authority of a breach within 72 hours of discovering it, unless the breach is unlikely to put people’s rights at risk. You must document every breach, its causes, its effects and what you did. The Authority may require you to tell the affected people if it finds the breach may lead to high risks.
If the Authority finds a breach of the law, it orders you to stop. If you do not comply in time, it may impose an administrative fine of up to 20,000 dinars. Some breaches are crimes. Processing sensitive data against the law, or transferring data abroad against the law, can bring up to 1 year in prison and a fine of 1,000 to 20,000 dinars, or one of the two. A company can be fined up to double that amount where the crime was committed in its name, for its account or for its benefit, and resulted from the conduct or gross negligence of one of its board members or officers.
What Bahrain says about AI itself
In July 2025 the Information and eGovernment Authority launched a National Policy for the Use of Artificial Intelligence, and adopted the Gulf Cooperation Council’s guiding manual on the ethics of AI use. The policy calls for compliance with national laws, including the Personal Data Protection Law. Both are policy and guidance. I found no Bahraini AI law in force as of October 2026.
Sector rules
Banks and other financial institutions answer to the Central Bank of Bahrain as well. The law requires the Authority’s chief executive to inform the Central Bank’s Governor of any inspection the Authority intends to carry out on a financial institution the Central Bank supervises.
What this means for you
- Record, for each kind of data the agent reads, the legal basis you rely on, and keep written consent where you rely on it.
- Before go-live, check whether you must notify the Authority, and whether the agent’s processing needs a prior permit.
- Find out where your model provider processes data, and check that country against the list before you send anything.
- If the agent assesses people, offer a way for a person to ask for a decision that does not rest on the machine alone, and do the impact assessment.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- Legislation and Legal Opinion Commission, Law No. 30 of 2018 issuing the Personal Data Protection Law
- Ministry of Legal Affairs, Personal Data Protection Law, English translation
- Legislation and Legal Opinion Commission, Decree No. 78 of 2019 naming the body that exercises the Authority’s powers
- Legislation and Legal Opinion Commission, Resolution No. 42 of 2022 on the transfer of personal data outside Bahrain
- Legislation and Legal Opinion Commission, Resolution No. 43 of 2022 on technical and organizational measures
- Personal Data Protection Authority, Executive Decisions
- Ministry of Justice, The Minister of Justice issues ten decisions to implement the Personal Data Protection Law, March 2022
- Information and eGovernment Authority, Bahrain launches National AI Policy and adopts GCC ethics manual, July 2025