The framework
The operative statute in Bahrain is the Personal Data Protection Law (Law No. 30 of 2018), enforced by the Personal Data Protection Authority.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Personal Data Protection Law (Law No. 30 of 2018)
In force since August 2019, Bahrain's law carries unusual criminal-law teeth, making certain violations, including unlawful sensitive-data processing and transfers, prosecutable offenses.
Marketing and advertising
Consent or listed grounds; direct marketing requires prior consent. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers go to adequacy-listed destinations or need authorization, with consent available as a derogation.
Enforcement and penalties
Criminal penalties including fines and imprisonment, plus administrative orders.