Manama, Kingdom of Bahrain — Advantari Digital Solutions W.L.L., operating as Advantari, has obtained a license from Bahrain's Personal Data Protection Authority (PDPA) to provide External Data Protection Guardian (DPG) services, helping businesses strengthen their privacy governance and maintain ongoing compliance with Bahrain's Personal Data Protection Law (PDPL).
Bahrain's PDPL, issued under Law No. (30) of 2018, provides the framework for how organizations collect, use, store, share and protect personal data. The PDPL applies to businesses established or operating in Bahrain and places responsibilities on organizations that handle personal information relating to customers, employees, suppliers and other individuals.
For businesses, PDPL compliance goes beyond having a privacy policy. Organizations are expected to ensure that personal data is collected and used for legitimate purposes, limited to what is necessary, kept accurate, retained only as long as required and appropriately protected. Businesses must also manage individuals' data protection rights and meet applicable regulatory requirements relating to their processing activities.
Internal DPG or External DPG
Bahrain's data protection framework allows businesses to appoint either an Internal Data Protection Guardian or an External Data Protection Guardian.
An Internal DPG performs the role from within the organization or its wider group and must meet the applicable requirements for registration.
An External DPG is an independent individual or company registered to provide the DPG function to businesses. This gives organizations access to dedicated data protection expertise and independent oversight without having to build and maintain the entire function internally.
For businesses without a dedicated privacy team, an External DPG can provide a practical way to manage PDPL responsibilities on an ongoing basis. It can also complement existing legal, compliance, risk, information security and governance teams by providing focused oversight of personal data protection requirements.
How Advantari Can Help
As a licensed External DPG provider, Advantari can act as a business's dedicated Data Protection Guardian, providing ongoing support and oversight to help the organization manage its PDPL obligations.
Under the PDPL, the DPG assists the business in meeting its data protection responsibilities, monitors how personal data is handled, identifies potential compliance issues, supports corrective action, liaises with the PDPA and maintains relevant processing records. The DPG is also required to perform its duties independently and impartially.
Through Advantari's External DPG service, businesses can receive practical support with:
- maintaining an effective PDPL compliance framework;
- monitoring how customer, employee and other personal data is handled;
- identifying privacy and compliance risks and supporting appropriate action;
- managing customer and employee data rights requests;
- supporting applicable PDPA notifications and prior authorization requirements;
- supporting personal data breach management and regulatory reporting;
- reviewing privacy requirements when introducing new technologies, systems, vendors or business processes; and
- providing management with ongoing visibility over the organization's data protection compliance.
The role provides businesses with a more structured approach to data protection. Rather than treating PDPL compliance as a one-time exercise, an External DPG can provide continuing oversight as the organization, its technology and its use of personal data evolve.
Ahmed Albalooshi, CEO of Advantari, said:
"Obtaining this license enables Advantari to provide businesses in Bahrain with dedicated and ongoing support in managing their PDPL responsibilities. Not every organization needs to build a full privacy function internally. Through our External DPG service, businesses can access specialist expertise and independent oversight to help them manage compliance practically, reduce privacy risks and build greater trust with their customers, employees and stakeholders."
Appointing an External DPG does not transfer the business's responsibilities under the PDPL. It does, however, provide management with dedicated expertise and independent oversight to help ensure those responsibilities are understood, monitored and managed effectively.
With its licensed External DPG service, Advantari aims to help businesses take a practical and sustainable approach to data protection compliance, allowing management teams to focus on their core operations while maintaining appropriate oversight of their PDPL responsibilities.