Transfers of personal data out of Bahrain is prohibited unless the transfer is made to a country or region that provides sufficient protection to personal data. The Authority has listed the countries in which it deems provides adequate regulatory and legislative protection for personal data. Data controllers would be permitted to transfer personal data directly to the states, countries and territories listed in the regulation, without obtaining prior authorization from the Authority. The list of 83 countries are as follows:

• Andorra, Bulgaria, Denmark, French Guiana, Iceland, Argentina, Canada, Ecuador, Georgia, India, Australia, Chile, Egypt, Germany, Ireland, Austria, China, Estonia, Greece, Isle of Man, Belgium, Colombia, Falkland Islands, Guernsey, Israel, Bolivia, Croatia, Faroe Islands, Guyana, United Kingdom, Brazil, Cyprus, Finland, Hong Kong, Italy, Brunei, Czech Republic, France, Hungary, Japan, Luxembourg, Nigeria, Russia, Switzerland, Jersey, Macau, Norway, San Marino, Thailand, Jordan, Malaysia, Oman, Singapore, Ukraine, Kazakhstan, Malta, Pakistan, Slovakia, United Arab Emirates, Kingdom of Saudi Arabia, Mexico, Paraguay, Slovenia, United States of America, Kuwait, Monaco, Peru, South Korea, Uruguay, Latvia, Morocco, Poland, Spain, Vatican, Liechtenstein, Netherlands, Portugal, Suriname, Venezuela,Lithuania, New Zealand, Romania and Sweden.                       

Data controllers can also transfer personal data to countries that are not determined to have sufficient protection of personal data where:

• the transfer occurs pursuant to a permission to be issued by the Authority on a case-by-case basis, if it deems that the
• data will be sufficiently protected;
• if the data subject has consented to that transfer;
• if the data to be transferred has been extracted from a register that was created in accordance with the PDPL for the purpose of providing information to the public, regardless of whether viewing of this register is available to everyone or limited to the parties concerned in accordance with specific terms and conditions. In this instance, one shall have to satisfy the terms and conditions prescribed for viewing the register before viewing that information;
• if the transfer is necessary for any of the following:
  • to implement a contract between the data subject and the data controller, or to undertake preceding steps at the data subject's request for the purpose of concluding a contract;
  • to implement or conclude a contract between the data controller and a third party for the benefit of the data subject;
  • to protect the data subject's vital interests;
  • to implement an obligation imposed by the PDPL (even if this is contrary to the contractual obligation), or to implement an order issued by a competent court, the public prosecution, the investigating judge or the military prosecution; or
  • to prepare, execute or defend a legal claim.