Law note · Bahrain
Personal Data Protection Law, data subject rights
What it requires
- An app that receives a data-subject request from an individual in Bahrain must respond within a fixed working-day deadline, ten or fifteen working days depending on the request type, rather than an open-ended reasonable-time standard.
When LexLint raises it
crawls_web
What we found
Section Five (Arts. 17-23) sets Bahrain's data-subject rights, each with its own working-day deadline. The Data Controller must notify a Data Subject who requests confirmation of processing within 15 working days (Art. 18(1)). It must halt or decline to begin direct-marketing processing and notify the Data Subject of its decision within 10 working days of a marketing objection (Art. 20(1)-(2)).
It must halt or decline to begin processing that causes material or moral damage within 10 working days of an objection on that ground (Art. 21(1)). It must respond to a rectification, blocking, or erasure request within 10 working days (Art. 23(1)).
Art. 17 separately requires the Data Controller to brief the Data Subject on the purposes of processing at the time data is obtained, Art. 19 requires notice of the right to object to direct marketing, and Art. 22 gives a Data Subject a right against a decision based solely on automated processing.
An earlier version of this document cited these deadlines to Art. 32 (Conflict of Interest, a provision about PDPA Board members with no bearing on data-subject rights); this instrument now cites the Section Five articles that actually carry them.