Bahrain Data Protection Law: Doing Business in Jurisdiction

The factor of Doing Business in Jurisdiction is used in determining the law's applicability by considering whether an organization has a commercial presence or engages in economic activities within Bahrain, regardless of where the processing takes place.

Text of Relevant Provisions

RPDPL Art.2(2)(b):

"This Law shall apply to the following persons: (b) Every legal person with a place of business in the Kingdom;"

RPDPL Art.2(2)(c):

"This Law shall apply to the following persons: (c) Every natural or legal person not habitually resident nor maintains a place of business in the Kingdom, but processes data by using means situated in the Kingdom, unless such means are used only for purposes of transit of data over the Kingdom’s territory."

Analysis of Provisions

The Bahrain Personal Data Protection Law (RPDPL) specifies that the law applies to legal persons with a place of business in Bahrain (Art.2(2)(b)) and to natural or legal persons who process data using means situated in Bahrain, unless such means are used only for transit purposes (Art.2(2)(c)).

These provisions indicate that the law's applicability is based on the presence of a commercial entity within Bahrain or the use of means situated in Bahrain for data processing. This means that any organization that has a place of business in Bahrain or uses means situated in Bahrain for data processing, other than for transit purposes, would be subject to the law.

Implications

The inclusion of this factor has significant implications for businesses operating in Bahrain. For example, a company that has a branch office in Bahrain would be subject to the law, regardless of where the data processing takes place. Similarly, a company that uses data centers or servers located in Bahrain for data processing would also be subject to the law, unless the data is only being transmitted through Bahrain for transit purposes.

Conversely, a company that does not have a place of business in Bahrain and does not use means situated in Bahrain for data processing would not be subject to the law.

For instance, a foreign company that processes personal data of Bahraini residents but does not have a presence in Bahrain and does not use Bahrain-based data centers or servers would not be subject to the law. However, if the same company were to establish a branch office in Bahrain or use Bahrain-based data centers or servers for data processing, it would be subject to the law.