IT business legal support in Bahrain
In Bahrain the filing comes before the processing. We handle the notice and the authorisation your product needs, and count what each developer on the team costs in permits.
Two-year permit
Разрешение на 2 года
BHD 390
390 BHD
Outside the quota
Сверх доли найма
BHD 500 more
плюс 500 BHD
From the sixth hire
С шестого работника
BHD 12.5 a month
12,5 BHD в месяц
Authorisation answer
Ответ по разрешению
30 days
30 дней
When an IT business in Bahrain needs legal support
You are about to start processing
Automated processing is notified to the authority in advance. The alternative is to appoint a data protection guardian, and that choice changes how the whole year runs.
Your feature uses face or fingerprint
Biometric verification, genetic and sensitive data, surveillance recording and the linking of files across companies wait for a written authorisation before they run.
Silence arrives instead of an answer
The authority decides on an authorisation request within thirty days of filing. No reply inside that window counts as a refusal, so silence is not something to wait out.
The team is growing quickly
A two-year work permit is a fixed cost per developer, and the monthly charge per expatriate rises once the sixth one is on the payroll.
Your data sits in a local centre
Bahrain lets a foreign customer keep content in a designated data centre under the law and the courts of their own country. That rule has conditions worth reading first.
An inspector asks for the register
Whoever holds the role keeps a register of everything notified, and a guardian sends the authority an updated copy of it every month.
What legal support for an IT business in Bahrain covers
Bahrain puts the paperwork in front of the product. Before an automated system touches personal data, the authority has either been notified of it or has authorised it, and the difference between those two words decides your timetable.
The second thing that surprises a growing team is that the data rules here are criminal as well as administrative. A breach of the notification or authorisation duty carries a prison term alongside the fine, and for a company the fine limits are doubled.
The rest of what we handle in Bahrain is set out on the Bahrain page, while the country-free version of this service is on the service page.
An engineering team feels this as a date: the filing has to land in the plan ahead of the release, and not beside it.
What you get
- The notification filed before the system goes live
- A decision on whether your feature needs authorisation
- The guardian question answered with its costs shown
- A register that survives an inspection
- A hiring budget with permit charges already in it
What the regulator wants and when
| Step | What the law fixes |
|---|---|
| Before automated processing | Prior notice to the authority, unless a guardian is appointed |
| Incomplete notice | Ten working days to be told, fifteen to fix, processing stops meanwhile |
| Anything changes | The authority is told within thirty days |
| Biometrics, genetics, surveillance | Written authorisation before processing begins |
| Decision on that request | Thirty days; no answer is an implied refusal |
| Guardian's monthly duty | An updated register to the authority every month |
| Processing without notice | Up to a year in prison, or 1,000 to 20,000 dinars |
| The same against a company | Both limits doubled |
What the team costs in permits
A two-year work permit is 390 dinars in total, one year is 195, and a permit issued outside the Bahrainisation percentage costs 500 dinars for two years on top. Monthly fees run at 7.5 dinars for each of the first five expatriate employees and 12.5 from the sixth onwards.
For a development team hired from abroad those numbers are the difference between a budget that holds and one that moves every time a seat is filled.
Where Bahrain is unlike its neighbours
A separate law lets a foreign party's content in a designated data centre stay under the exclusive jurisdiction of its own country's courts and authorities, with the provider obliged to tell the public prosecution when a foreign order arrives. If a centre or a country is removed from the designated list, the regime still covers it for a hundred and twenty days.
Sources: the Personal Data Protection Law No. 30 of 2018, Decree-Law No. 56 of 2018 on cloud computing services to foreign parties and the work permit fees published by the labour market regulator.
Stages of work
Listing what the systems already do
We write out every automated processing operation, its purpose, whose data it touches, what kind of data that is and who receives it, because that list is literally what the notification asks for.
Notification or a guardian, decided
Appointing a guardian removes the duty to notify each operation and adds a monthly register instead. We show both routes with what each costs in time and in people.
Filing before the release date
The notice or the authorisation request goes in with enough room for the statutory clocks, so that a launch date is not waiting on a decision that has thirty days to arrive.
Building the register that is shown
The record of processing is kept in the shape an inspector expects and updated when a purpose, a recipient or a transfer changes.
Pricing the hires and the transfers
Permit charges, the surcharge for hiring outside the percentage and the monthly fee per worker are put into the hiring plan before an offer is made.
Cover for each new feature that lands
A new feature that touches biometrics or surveillance restarts the authorisation question, and the answer comes back before the code ships.
Our case studies
FAQ
Discuss
the Task
Speak to our team
Speak to our team. Tell us about your task –
we’ll help you with it in any jurisdiction.