Bahrain Personal Data Protection Law (PDPL, Law No. 30 of 2018): AI Compliance Requirements

PDPL Article 4 requires a documented lawful basis for any personal data processing: consent, contract performance, legal obligation, vital interests, or legitimate interests. AI systems processing Bahraini residents' data must document their lawful basis before processing begins and update privacy notices to reflect AI-specific processing activities.

PDPL Article 14 grants individuals the right not to be subject to solely automated decisions that significantly affect them without human intervention. AI credit scoring, fraud detection, and profiling systems in Bahrain must implement a human review mechanism, provide explanations on request, and document the decision logic.

PDPL Article 6 requires organizations processing personal data to register with the PDPA (Personal Data Protection Authority under iGA) before commencing data processing activities. Registration must include the purposes of processing, categories of data subjects, and whether automated decision-making is used.

Bahrain PDPL Art. 22: certain controllers — public authorities, or entities whose core activities involve large-scale systematic monitoring or large-scale processing of sensitive data (a common profile for AI/ML systems) — must appoint a Data Protection Guardian (the PDPL's DPO equivalent) and notify the PDPA within 3 working days of the appointment. Separately, on discovering a personal data breach, the controller must notify the PDPA within 72 hours, and must notify affected data subjects without undue delay where the breach is likely to cause high risk to their rights (unless the data was rendered unintelligible, e.g. by encryption, or subsequent measures eliminated the high risk).

The Central Bank of Bahrain (CBB) and Bahrain FinTech Bay require financial AI systems to undergo regulatory review prior to deployment. CBB Rulebook Volume 6 requires model risk management for AI-driven credit and investment decisions. AI systems must maintain audit trails for at least 5 years.