Bahrain, Saudi Arabia
External Data Protection Guardian (DPG) Services in Bahrain
VirtuThinko W.L.L. acts as your licensed External DPG under the Personal Data Protection Law, managing your register, PDPA liaison, data requests and breach response.
Bahrain PDPL at a glance
- Law No. 30
- of 2018: Bahrain's Personal Data Protection Law, in force since 1 August 2019
- 72 hours
- to notify the Authority of a personal data breach, unless it is unlikely to pose a risk to individuals’ rights
- 10 days
- after which a DPG must report a violation to the Authority if serious evidence exists and the controller has not remedied it
- BHD 20,000
- maximum criminal fine for serious PDPL offences, with up to one year's imprisonment
Our External DPG licence
VirtuThinko W.L.L. is registered by Bahrain's Personal Data Protection Authority as an External Data Protection Guardian, so we can take on the DPG role for your organisation under the Personal Data Protection Law.
- Licence number
- DPG-26 120 1114
- Issued by
- Personal Data Protection Authority
- Licensee
- VirtuThinko W.L.L.
- Registered
- August 2026
What is a Data Protection Guardian?
A Data Protection Guardian (DPG) oversees how an organisation handles personal data under Bahrain's Personal Data Protection Law, Law No. (30) of 2018 (PDPL). Recorded in the Personal Data Protection Authority's register, the DPG helps the data controller meet its PDPL obligations, monitors processing activities, maintains the register of processing operations and acts as the point of contact with the Authority. VirtuThinko W.L.L. is licensed by the Personal Data Protection Authority (PDPA) to act as an External DPG, giving your organisation independent, specialist oversight without building a full privacy function in-house.
Data controller
Your organisation
Decides how personal data is used and remains accountable under the PDPL.
Advises, monitors processing and keeps the register of processing operations
Licensed External DPG
VirtuThinko
Independent, impartial oversight of how your organisation processes personal data.
Point of contact and notifications; escalates violations not remedied within 10 days
Regulator
Personal Data Protection Authority
Keeps the Data Protection Guardians Register and enforces the PDPL.
What our External DPG service covers
One licensed team covers the DPG role end to end, so your obligations under the PDPL are tracked and evidenced.
Register of Processing Operations
We build and maintain your register of processing activities and keep notifications to the Authority current, so your records are always ready for inspection.
PDPA Liaison and Notifications
We act as your point of contact with the Personal Data Protection Authority and prepare notifications and prior-authorisation requests, for example for biometric data or CCTV monitoring.
Ongoing Compliance Monitoring
Regular reviews of how customer, employee and supplier data is collected, used, stored and shared, with clear findings and corrective actions for management.
Data Subject Requests
Procedures and response handling for requests to access, correct, object to or erase personal data, so individuals' rights are met consistently.
Breach Readiness and Response
Incident playbooks, breach assessment and support with notifying the Authority within 72 hours when a reportable breach occurs.
Privacy Reviews for New Initiatives
Privacy impact reviews of new systems, AI tools, vendors and cross-border transfers before they go live, so compliance is built in from the start.
Internal or External DPG?
Bahrain's framework allows two routes. Both must be recorded in the Authority's Data Protection Guardians Register.
| Topic | Internal DPG | External DPG |
|---|---|---|
| Who it is | Internal DPG: An employee of the data controller or its group | External DPG: An independent individual or licensed firm providing the role as a service |
| Eligibility | Internal DPG: Must hold permanent residency in Bahrain | External DPG: Must meet the Authority's qualification conditions |
| Expertise | Internal DPG: Built through in-house hiring and training | External DPG: Specialist knowledge and independent oversight from day one |
| Continuity | Internal DPG: Needs a new appointment when the employee leaves | External DPG: Continues when your staff change |
Either way, appointing a DPG does not transfer legal responsibility: the data controller remains accountable under the PDPL.
Who needs a Data Protection Guardian?
Banks, Insurers and CBB Licensees
Financial institutions process large volumes of customer and payment data under close regulatory scrutiny.
Healthcare Providers
Hospitals, clinics and laboratories process health data, a category of sensitive personal data that calls for stricter controls.
Retail and E-commerce
Online stores and loyalty programmes collect customer and payment data at scale, often across borders.
Employers with Large Workforces
HR, payroll and CCTV records are personal data, and visual monitoring requires the Authority's prior authorisation.
Technology and SaaS Providers
Platforms that process data for clients need clear controller and processor responsibilities and strong safeguards.
Government Suppliers
Public-sector clients increasingly expect suppliers to demonstrate PDPL compliance in tenders and contracts.
How onboarding works
- 01
Discovery and Scoping
We learn how your organisation collects, uses and shares personal data.
- 02
Gap Assessment
We measure current practices against the PDPL and its resolutions.
- 03
Appointment and Registration
We complete the DPG appointment and notifications with the Authority.
- 04
Remediation Roadmap
We prioritise fixes to policies, notices, contracts and controls.
- 05
Ongoing Guardianship
Continuous monitoring, reporting to management and PDPA liaison.
For most data controllers, appointing a DPG is currently voluntary, but the Authority's Board can require specific categories of controllers to appoint one. Where no DPG is appointed, the data controller must maintain the register of processing operations itself.
A DPG helps the data controller comply with the PDPL, verifies that personal data is processed lawfully, maintains the register of processing operations and acts as the point of contact with the Personal Data Protection Authority. If the controller does not remedy a reported violation within ten days, the DPG must notify the Authority. The DPG must perform these duties independently and impartially.
An internal DPG is an employee of the data controller or its group who holds permanent residency in Bahrain. An external DPG is an independent individual or licensed firm that provides the role as a service. Both must be recorded in the Authority's Data Protection Guardians Register.
No. The data controller remains responsible for complying with the PDPL. An external DPG provides specialist expertise and independent oversight to help you meet those responsibilities and show that you are managing them.
A breach must be reported to the Authority within 72 hours of its discovery, unless it is unlikely to affect the rights of the individuals concerned. A DPG helps you assess incidents quickly and prepare the notification.
Serious offences, such as unlawfully processing sensitive data, transferring data abroad without a legal basis or processing without notifying the Authority, can lead to imprisonment of up to one year and/or a fine of BHD 1,000 to BHD 20,000. The Authority can also issue orders and administrative fines, and individuals can claim compensation for damage.
Yes. VirtuThinko W.L.L. is licensed by Bahrain's Personal Data Protection Authority to provide External Data Protection Guardian services.
Yes. Alongside the External DPG role, our PDPL compliance service covers assessments, data mapping, policies and procedures, privacy notices and staff awareness, so you can build a complete programme with one team.
Appoint a licensed External DPG
Speak with our data protection team about your processing activities and how an External DPG engagement would work for your organisation.