A Bahrain PDPL checklist for a software project turns Law No. 30 of 2018 into design decisions: what personal data you collect and why, the lawful basis for each use, how consent is captured, who can see the data, where it is hosted, how long it is kept, and how people exercise their rights. This guide is practical, not legal advice. Confirm your obligations with your adviser.
What is the Bahrain PDPL and does it apply to your software?
The Personal Data Protection Law, Law No. 30 of 2018, is Bahrain's main data protection law and came into force in 2019. If your system processes personal data of people in Bahrain, or you process data in Bahrain, assume it applies and check the details with your adviser.
Personal data is any information that identifies a person directly or indirectly: names, phone numbers, CPR numbers, email addresses, location history, photos, and account or payment details. Business software holds far more of it than people expect. A CRM, an HR system, a delivery app with driver tracking and a booking website all process personal data.
The law is supervised by the Personal Data Protection Authority. It also has implementing resolutions that add detail, and some sectors, such as licensed financial institutions, have extra rules. Laws and guidance change, so treat this checklist as a starting point for a conversation with your legal team, not a final answer.
Which personal data should the system collect?
Only what each feature genuinely needs. Data you never collect cannot leak, does not need consent and does not need to be deleted later.
Go through every form and every database table and ask what the field is used for. Date of birth, nationality, CPR number and a copy of an ID card are often collected out of habit. If a feature needs one of them, write down why. If not, remove it. Pay extra attention to sensitive data, such as health information, religious beliefs or criminal records, which the law treats with stricter conditions.
- A data map: each type of personal data, where it is stored, who can access it and why
- A purpose for each field, written in plain language
- The lawful basis for each purpose, agreed with your adviser
- Sensitive data identified and isolated, with tighter access
- Retention periods for each type of data, and a plan to delete or anonymise it
- A list of every third party that receives the data: hosting, SMS, email, analytics, payments
How should consent and privacy notices work in the app?
Where you rely on consent, ask for it clearly, separately from other terms, and record it. People should be able to withdraw it as easily as they gave it.
In practice that means a short privacy notice in Arabic and English at the point of collection, unticked opt-in boxes for marketing, and a stored record of what the person agreed to and when. The PDPL gives people the right to object to their data being used for direct marketing, so the system should honour an opt-out across email, SMS and WhatsApp, not only in one channel. Cookie banners on websites should reflect what the site actually loads, and analytics or advertising tags should wait until the visitor has agreed where consent is the basis you rely on.
What security measures should be built in?
The law expects controllers to protect personal data with appropriate technical and organisational measures. For software, that means security is part of the design, not a final review.
- Role-based access, so staff see only the records their job needs
- Strong authentication for admin users, with two-factor login where possible
- Encryption in transit everywhere and at rest for databases and backups
- Audit logs of who viewed, exported, changed or deleted personal data
- Masking of sensitive fields such as CPR numbers in screens and exports
- Secure handling of secrets and keys, never stored in source code
- Regular backups, tested restores and a documented incident response plan
- Security testing before launch and after major changes
Our quality assurance team adds access-control and data-exposure checks to the test plan, so a screen that shows another user's record fails a test before it reaches production.
Where can the data be hosted and transferred?
The PDPL restricts transfers of personal data outside Bahrain unless the destination offers adequate protection or another condition in the law applies. Decide hosting with your adviser before you build, not after.
Bahrain is generally comfortable with cloud hosting, and major cloud providers offer regions in the Gulf. If your data must stay in the Kingdom, or must stay within approved destinations, choose the cloud region and every third-party service with that in mind. Remember that support tools, email services, analytics and error-tracking tools also receive personal data. A common approach is to host the production database in a chosen region, keep developers working on anonymised test data, and give the supplier access only through audited accounts owned by your company.
For example, a Bahrain recruitment agency building a candidate portal might store CVs and ID documents in a Gulf cloud region under its own account, limit recruiters to candidates in their assigned roles, log every CV download, and delete unsuccessful applications after a retention period agreed with its legal adviser.
How should the system handle people's requests?
People have rights over their data, including to be informed about processing and to request access, correction and, in some cases, deletion or objection. The system should make those requests quick to answer.
Build an admin tool that finds every record for one person across modules, exports it in a readable format, and corrects or deletes it with an audit trail. Without such a tool, a single request can take days of manual searching. Also plan for deletion inside backups and logs, which often hold copies long after the main record is gone.
What should your contract with a software supplier say?
Your supplier will often process personal data on your behalf, during development, support or hosting. The contract should make that relationship and its limits clear.
- The supplier processes personal data only on your written instructions
- Production data is not used in development or testing without your approval
- Named people have access, through accounts you control and can revoke
- Security incidents are reported to you promptly, with details
- Code, cloud accounts and data are registered to your company
- Data is returned or deleted when the contract ends
How is a privacy-aware software project usually run?
Privacy decisions are made in the first workshops and written into the scope, then checked at each release. That is cheaper than retrofitting them.
We start with video-call workshops where your team, and ideally your adviser, agree the data map, purposes and hosting. The written scope records those decisions. A named lead engineer owns them through delivery. Work runs in two-week sprints with a demo each sprint, and releases are phased so access controls, consent capture and audit logs arrive with the first version, not later. Testing covers permissions and data exposure. At handover, code and cloud accounts are registered to your company. Our custom solutions page describes the kind of systems we build, and our Bahrain page explains how we work with companies there.
Frequently asked questions
Does the PDPL apply to B2B software?
Often yes. Even a business-to-business system holds personal data about contacts, employees and users. Ask your adviser how the law applies to your specific processing.
Can we host our Bahrain customer data outside Bahrain?
Possibly, but transfers abroad are restricted and depend on the destination and the conditions in the law. Confirm with your adviser or the Personal Data Protection Authority before choosing a hosting region.
Is a cookie banner enough for website compliance?
No. A banner is one part. The site must also load tags according to the visitor's choice, have a clear privacy notice and handle personal data from forms securely.
Do we need a data protection officer?
Under the PDPL, appointing one is required for some organisations and optional for others. Your adviser can confirm what applies to you.
If you are planning a new system or want to review how an existing one handles personal data, talk to us about building privacy into the scope from day one.
This guide was researched and drafted with the help of AI tools, then checked for accuracy against our editorial rules. Laws, tax rules and prices change: confirm current requirements with your adviser before you decide.
Working on something similar?
See our Web Development Company for GCC & US Businesses page, or talk it through with us, with no obligation.
