Law No. 30 of 2018 with respect to Personal Data Protection — data breach notification

Controllers must inform the Personal Data Protection Authority of a data breach within 72 hours of discovery, unless the breach is unlikely to affect data subjects' rights, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and interests. Bahrain follows the GDPR in excusing individual notification where the controller had applied protective measures such as encryption that render the data unintelligible, or where subsequent measures mean the high risk is no longer likely to materialise. Marked 'check': the 72-hour deadline and the notification conditions sit in the implementing Ministerial Orders rather than plainly in the Law, and the operative texts are Arabic-language originals — confirm the provision your obligation actually rests on before citing it.