Under the PDPL, the Authority will have power to investigate violations of the PDPL on its own, at the request of the responsible minister, or in response to a complaint.

The Authority can issue orders to stop violations, including issuing emergency orders and fines. Civil compensation is also allowed for any individual who has incurred damage arising from the processing of their personal data by the data controller, or violating the provisions of the PDPL by a business's data protection officer. Finally, the most concerning feature of the PDPL for businesses is that it carries criminal penalties for violations of certain provisions.

Decree No. 78 of 2019 (the " Decree") was enacted to determine the administrative authority that will assume the mandated functions and powers of the Authority. This Decree came into force September 29, 2019.

Article I of the aforementioned Decree appoints the Ministry of Justice, Islamic Affairs and Endowments (the " Ministry") as the Authority for the protection of personal data in accordance with the provisions of the PDPL, on a temporary basis pending the financial allocation of the Authority in the general budget of Bahrain and the issuance of a decree forming the Board of Directors pursuant to Article 39 of the PDPL.

The Minister of the Ministry will assume the functions and powers prescribed to Board of Directors of the Authority and the Chairman of Board of Directors, in accordance with the provisions of the PDPL The Undersecretary of the Ministry will assume the same functions and powers as the Executive Chairman.