Gulf States Data Protection Laws: Bahrain, Oman and Kuwait obligations compared

Bahrain, Oman and Kuwait regulate personal data in three very different ways, so a single Gulf privacy programme built on one model will miss permits, breach clocks or registrations in at least one of them. Bahrain has had a full data protection law since 2019, Oman's law became fully enforceable in February 2026, and Kuwait still has no general data protection statute, relying instead on a telecoms regulator's rule and older e-transactions law. This guide covers the privacy rules only, for security, privacy and engineering leads who run systems or process customer data in these three countries. Saudi Arabia and the UAE have their own pages, and cyber security regimes such as the Central Bank of Bahrain Rulebook are covered in the Gulf comparison guide.

Status checked 14 November 2026 against the official law texts and current legal reviews. Laws and implementing rules in the Gulf change often, so confirm the position before relying on any date or figure.

Key takeaways

• Bahrain is the mature regime: Law No. 30 of 2018 has applied since 1 August 2019, with ten implementing resolutions in force since 18 March 2022, and the Ministry of Justice acting as the Authority.
• Oman's grace period is over: the transition under the Executive Regulations ended on 5 February 2026, so DPO appointment, sensitive data permits and 72-hour breach notice now apply in full.
• Kuwait has no general law: the CITRA Data Privacy Protection Regulation, as amended by Decision No. 26 of 2024, binds CITRA licensees and sets a 24-hour breach clock; everyone else relies on the E-Transactions Law.
• Prior approval is the hidden trap: Bahrain requires written authorisation for biometric verification and similar processing, and Oman requires a Ministry permit for any sensitive data processing.
• Transfers are consent or approval driven: Bahrain uses an adequacy white list and BCRs, Oman needs express written consent plus a documented assessment, and Kuwait licensees must disclose destination countries.

The three regimes at a glance

For the wider picture, including the Saudi PDPL, the UAE federal law and the free zones, see the Global Privacy Regulatory Map. The table below sets out only the three countries this page covers.

Bahrain: Law No. 30 of 2018

Bahrain's law was promulgated on 12 July 2018 and took effect on 1 August 2019. Its structure will feel familiar to anyone who knows the GDPR, but it adds a notification and prior authorisation layer that GDPR dropped.

Core obligations

• Principles and lawful bases: Article 3 sets fair processing, purpose limitation, minimisation, accuracy and retention limits. Article 4 requires consent unless processing is needed for a contract, a legal obligation, vital interests or legitimate interests.
• Sensitive data: health, religion, political opinion and criminal records, among others, may be processed only under the conditions in Article 5.
• Security: Article 8 requires appropriate technical and organisational measures and governs processor contracts. The 2022 resolution on technical and organisational measures adds privacy by design, data protection impact assessments and vulnerability assessment and penetration testing (VAPT).
• Data Protection Guardian: appointment under Article 10 is optional, but the Board may require it for certain controllers, and the Authority must be told within three working days of an appointment.
• Rights: Articles 17 to 25 cover information, access, objection to direct marketing and damaging processing, automated decisions, rectification, blocking and erasure, consent withdrawal and complaints.

Notification and prior authorisation

Article 14 requires controllers to notify the Authority before carrying out wholly or partly automated processing, subject to listed exemptions. Article 15 goes further and requires prior written authorisation for automated processing of sensitive data, biometric identity verification, genetic data, linking files held by different controllers for different purposes, and visual recording used for surveillance. For security teams the biometric and CCTV items matter most: a fingerprint door system or face match login in Bahrain is an authorisation question before it is a technology question.

Breach notice and transfers

The 2022 resolutions introduced a breach notification mechanism, and DLA Piper's current summary reports that controllers must notify the Authority within 72 hours of discovering a breach unless it would not affect data subjects' rights. Transfers outside Bahrain are lawful under Article 12 only to countries on the Authority's adequacy list or with case-by-case authorisation; Article 13 adds exemptions such as consent and contractual necessity. The transfer resolution published a white list of adequate countries and recognises binding corporate rules.

Penalties

Under Article 55 the Authority can impose a daily penalty of up to BD1,000 (BD2,000 for a repeat within three years) and an administrative fine of up to BD20,000. Article 58 makes unlawful sensitive data processing, unlawful transfers and processing without notification or authorisation crimes punishable by up to one year in prison and a fine of BD1,000 to BD20,000. Article 59 lets a court fine a legal person up to double the maximum.

Oman: Royal Decree No. 6/2022 and its Executive Regulations

The law was published in Official Gazette issue 1429 on 13 February 2022 and took effect a year later. MTCIT issued the Executive Regulations as Ministerial Decision No. 34/2024, then extended the transition with Ministerial Decision No. 6/2025; that period ended on 5 February 2026, when the law became fully enforceable.

• Consent first: consent must be explicit, informed and obtained before processing unless a statutory exclusion applies, and privacy notices must name the controller, purpose, data source and rights before collection.
• Sensitive data permit: Article 5 lists genetic, biometric, health, ethnic origin, sex life, political or religious opinion, criminal conviction and security measure data. Processing any of them needs a Ministry permit. Applicants file a form, their data protection policy and their breach precautions; MTCIT has 45 days to decide, silence counts as refusal, and permits last up to five years.
• Security: Article 13 requires controllers to identify risks to data subjects and apply technical and procedural measures. Violating it carries a fine of OMR 5,000 to 10,000 under Article 27.
• DPO: Article 20 makes a Personal Data Protection Officer mandatory. CMS reports that MTCIT prefers the officer to be in Oman.
• Breach: Article 19 requires notice to the Ministry and the data subject. The regulations set 72 hours to notify MTCIT where rights may be harmed, with details of the breach, the controller and corrective actions, and further notice where the harm is serious. Every breach must also be logged with cause, consequence and remediation.
• Rights: withdrawal of consent, correction, deletion, copies and portability; written requests must be answered within 45 days.
• Transfers: Article 23 allows transfers under regulatory controls. The regulations generally require express written consent, an assessment that the recipient's protection is at least equal to Omani law and a report kept ready for MTCIT. CMS notes that sensitive data transfers may also need Cyber Defence Centre approval.

Kuwait: CITRA rules and the E-Transactions Law

Kuwait has no single data protection statute and no national data protection authority. Two layers apply instead.

• CITRA licensees: the Data Privacy Protection Regulation, as amended by Decision No. 26 of 2024 (published in the Official Gazette on 18 February 2024, with one year to comply), applies to CITRA licensed telecom and internet providers. Legal reviews differ on reach: DLA Piper reads the service provider definition as broad enough to catch websites, apps and cloud services, while Chambers' 2026 guide says it now applies exclusively to licensees. If you hold any CITRA licence, assume you are in scope.
• What licensees must do: obtain consent after stating purpose, terms and conditions (in Arabic and English), keep records of processing, apply privacy by design, maintain internal policies, run audits, disclose any foreign destination countries, and honour access, correction, removal, restriction, objection, portability and withdrawal requests. Withdrawal triggers deletion.
• 24-hour breach clock: licensees must tell CITRA and affected users within 24 hours of becoming aware of a breach, including DPO contact details. Individual notice is not needed if effective protection such as encryption was applied to the data.
• Everyone else: E-Transactions Law No. 20 of 2014 requires protection of stored data, restricted employee access and bans processing without consent. Article 37 carries up to three years in prison and a KWD 5,000 to 20,000 fine. The Cybercrime Law No. 63 of 2015 covers unauthorised access.
• Localisation relaxed: CITRA's Data Classification Policy, which kept Tier 4 national data in Kuwait, was repealed in February 2024, so there is no general localisation rule, although sector rules remain.

Enforcement on licensees runs through the CITRA Law; under its Article 49 CITRA may give a licensee 90 days to remove a violation. The National Centre for Cybersecurity, set up by Decree No. 37 of 2022, regulates cyber security, mainly for government bodies.

Where identity and machine access fit

All three regimes turn on who and what can reach personal data. Bahrain's Article 8 and Oman's Article 13 both require technical measures matched to risk, and a regulator reviewing a breach will ask which accounts held access. In practice the gap is rarely the human user base: it is service accounts used by CRM integrations, API keys held by billing processors, and AI agents given read access to customer tables. Record each of them in the processing register, scope them to the purpose stated in the notice, and log their access so a 24 or 72 hour report can say what was touched. See the AI Agents and Data Subject Rights guide for how rights requests reach agent memory and logs.

Building one programme for three countries

1. Map entities and licences: list each legal entity, where it processes data and whether it holds a CITRA licence. This decides whether Kuwait's regulation applies at all.
2. Inventory processing: build one record of processing that also captures the Bahrain notification and Oman permit fields. See the Data Mapping and ROPA Guide.
3. Flag approvals: mark biometric, genetic, health and surveillance processing. File Bahrain Article 15 authorisations and Oman sensitive data permits before go-live; allow at least 45 days in Oman.
4. Appoint officers: appoint an Oman DPO, decide on a Bahrain Guardian and notify within three working days, and name a breach contact for CITRA.
5. Set the breach clock to the shortest: run one incident procedure with a 24-hour regulator target where Kuwait licensees are involved and 72 hours elsewhere, with templates for each regulator.
6. Document transfers: check Bahrain's white list or BCRs, collect express written consent and an assessment report for Oman, and list destination countries for Kuwait.
7. Test and evidence: run DPIAs and VAPT as Bahrain's 2022 measures expect, then rehearse a breach notice with legal and the DPO.

Decision guidance

• Small organisation in one country: follow that country's text directly; a group-wide GDPR programme plus a local annex is usually enough for Bahrain, but Oman's permits and DPO need local action.
• Regional group: use the strictest element of each regime as the group standard (24-hour internal triage, mandatory DPO, consent records) and keep country annexes for permits, registrations and penalties.
• Kuwait non-licensee: there is no breach deadline, but customers and partners in Bahrain or Oman often impose one by contract, so keep the same playbook.

Measuring compliance

• Approval coverage: percentage of sensitive or biometric processing activities with a current Bahrain authorisation or Oman permit (target 100%).
• Breach timeliness: median hours from detection to regulator notice, tracked against 24 and 72 hours.
• Rights response time: share of Oman requests closed within 45 days.
• Transfer documentation: percentage of cross-border flows with a recorded ground, consent or assessment.
• Machine access hygiene: percentage of service accounts and API keys with access to personal data that have a named owner and a stated purpose.

Framework mapping

Common failure patterns

• Treating Bahrain like GDPR: teams skip Article 14 notification and Article 15 authorisation because GDPR has no equivalent, then deploy biometric access control without approval.
• Assuming Oman is still in transition: the grace period ended on 5 February 2026; programmes planned around a later date are now exposed.
• Missing Oman's permit lead time: silence after 45 days is a refusal, so a late application blocks a launch.
• Reading Kuwait as unregulated: CITRA licensees face a 24-hour clock, shorter than most regimes, and the E-Transactions Law still applies to others.
• Undocumented transfers: Oman's fines for transfer breaches reach OMR 500,000, by far the highest figure in its law, yet cloud backups abroad are often left off the transfer register.
• Forgotten machine access: integrations and AI agents with standing access to customer data are not in the processing record, so breach reports cannot state scope in time.

Practitioner checklist

• Confirm for each entity whether Bahrain, Oman or the Kuwait CITRA regulation applies.
• File Bahrain Article 14 notifications and Article 15 authorisations before processing starts.
• Hold a current Oman sensitive data permit for every relevant activity, with renewal dates tracked.
• Appoint and publish an Oman DPO; decide and notify any Bahrain Guardian.
• Run one breach procedure with 24-hour and 72-hour regulator templates.
• Record a transfer ground, consent or assessment for every cross-border flow.
• Answer Oman rights requests within 45 days and log the outcome.
• Include service accounts, API keys and AI agents in the processing record with owners.
• Recheck each regulator's site and the Official Gazettes every quarter.

Standards and references

• Kingdom of Bahrain: Law No. 30 of 2018 on Personal Data Protection
• Qanoon.om: Royal Decree 6/2022 Promulgating the Personal Data Protection Law (text reproduction)
• CMS: Oman Personal Data Protection Law entering the enforcement phase
• Al Tamimi: The new Executive Regulations of the Personal Data Protection Law of Oman
• Al Tamimi: Bahrain Personal Data Protection Authority issues 10 ministerial decisions
• Al Tamimi: Kuwait Data Privacy Protection Regulations
• Chambers: Data Protection and Privacy 2026, Kuwait
• DLA Piper: Data Protection Laws of the World, Bahrain

Related NHI Mgmt Group resources: Saudi Arabia PDPL Guide · UAE PDPL Guide · Gulf Cybersecurity Regulations Compared · Breach Notification Laws by Country Guide. This guide summarises the data protection laws of Bahrain, Oman and Kuwait as at November 2026 and is not legal advice.