The Authority can issue orders to stop violations, including emergency orders and fines. Civil compensation is also allowed for any individual who has incurred damage arising from the processing of their personal data by the data controller, or arising from the data protection officer's violation of the PDPL Appeals can be made against decisions of the Authority.

The PDPL also carries a range of criminal penalties and administrative fines for violating certain provisions.

Criminal penalties of imprisonment of not more than one year and / or a fine between BHD 1,000 to BHD 20,000, can be issued against any individual who: 

• processes sensitive personal data in violation of the PDPL;
• transfers personal data outside Bahrain to a country or region in violation of the PDPL;
• processes personal data without notifying the Authority;
• fails to notify the Authority of any change made to the data of which they have notified the Authority;
• processes certain personal data without prior authorization from the Authority;
• submits to the Authority or the data subject false or misleading data to the contrary of what is established in the records, data or documents available at their disposal;
• withholds from the Authority any data, information, records or documents which they should provide to the Authority or enable it to review them in order to perform its missions specified under the PDPL;
• causes to hinder or suspend the work of the Authority's inspectors or any investigation which the Authority is going to make; and / or
• discloses any data or information which they are allowed to have access to, due to their job or which they used for their own benefit or for the benefit of others unreasonably and in violation of the provisions of the PDPL.