Keypoint licensed to provide external data protection guardian services
Keypoint Solutions W.L.L. has been authorised by Bahrain’s Personal Data Protection Authority (PDPA) to provide data protection guardian (DPG) services as an external service provider. The approval strengthens Keypoint’s existing data privacy offering and means organisations in Bahrain can now access an independent DPG function supported by Keypoint’s technology, information security, risk and data privacy expertise.
Bahrain’s personal data protection law (PDPL) outlines a framework for processing and protecting personal data in the kingdom. The DPG role is established under Article 10 of the PDPL, while Order 46 of 2022 outlines the role of internal and external DPGs, as well as establishing a DPG register.
What is a DPG?
A recognised privacy function under Bahrain’s PDPL, DPGs support data controllers, independently and impartially helping them meet their data privacy obligations, liaise with the PDPA, monitor compliance and maintain required processing records. Bahrain’s data privacy framework allows data controllers to appoint an internal or external DPG – and must notify the PDPA of that appointment within three working days. External DPGs must meet applicable requirements and be enrolled in the PDPA’s DPG register.
What do DPGs do?
- Oversee PDPL compliance programmes
- Liaise with Bahrain’s PDPA
- Monitor how personal data is processed and identify potential compliance issues
- Support corrective actions where compliance issues are identified
- Maintain processing registers and support applicable regulatory updates
- Support privacy governance as systems, business processes, vendors and data uses change
What is Keypoint’s DPGaaS?
Keypoint’s data protection guardian as a service (DPGaaS) model combines the statutory external DPG role with practical privacy programme support. While the exact scope is tailored to an organisation’s processing environment, risk profile and existing internal capabilities, typical activities include:
- PDPL gap and readiness assessments
- External DPG onboarding and operating model
- Data mapping and records of processing activities (RoPA)
- Data protection impact assessments (DPIAs) and privacy-by-design reviews
- Privacy policies, procedures, notices and governance documentation
- Support for data subject rights requests and privacy queries
- Personal data breach responses and applicable PDPA processes
- Support with regulatory notifications and prior authorisation requirements where applicable
- Reviews of data processors, third parties and cross-border data transfer arrangements
- Management reporting, action tracking and privacy awareness sessions
Why use an external DPG?
For organisations without a dedicated in-house privacy function, our DPGaaS offering provides specialist expertise, continuity and independent oversight. It also complements existing legal, compliance, risk, internal audit, technology and information security teams by providing a dedicated focus on personal data protection.
Appointing an external DPG does not transfer accountability. While data controllers remain responsible for their obligations under the PDPL, DPGs provide expertise, monitoring and regulatory interfaces that help those responsibilities remain visible and actively managed.
Why Keypoint?
- Licensed/registered external DPG capability
- >20 years of local market experience
- Credentials across data privacy frameworks, DPIAs, RoPA, awareness, technology risk and information security
- A multidisciplinary team able to connect privacy requirements with practical governance and technical controls
- 30+ data privacy clients
Frequently asked questions (FAQs)
What is Bahrain’s personal data protection law?
Law 30 of 2018 regulates the processing of personal data and is supported by implementing orders covering security measures, sensitive personal data, regulatory notifications, data transfers, data subject rights and data protection guardians.
What is DPGaaS?
DPGaaS, or data protection guardian as a service, is Keypoint’s service model for providing the external DPG function together with supporting privacy governance activities.
Do DPGs need to comply with specific requirements?
External DPGs – who can be natural or legal persons – must be registered as external data protection guardians in Bahrain’s DPG register. Individuals/natural persons are required to demonstrate legal competence, good conduct, and specific educational or professional backgrounds while also completing an externally validated DPG qualification. Corporate entities – legal persons – providing outsourced DPG services must hold a valid commercial license in Bahrain and ensure that assigned staff meet the natural person qualification standards.
Does every organisation in Bahrain have to appoint a DPG?
No – but the PDPL allows PDPA – as Bahrain’s competent authority – to require specified categories of data controllers to appoint a DPG. Organisations should ensure applicable sector-specific regulatory requirements are complied with.
Does appointing an external DPG transfer an organisation’s responsibilities under the PDPL?
No. The data controller remains responsible for complying with the PDPL. The external DPG supports the organisation through oversight, monitoring, advice, record-keeping and regulatory liaison.
What is the difference between an internal and an external DPG?
Internal DPGs are employed by the data controller (or within an eligible group structure). External DPGs are not part of the organisation. Both internal and external DPGs must be enrolled in the DPG register – external DPGs should be enrolled in the external DPG section.
How else can Keypoint support Bahrain PDPL compliance?
Keypoint can support PDPL readiness assessments, privacy frameworks, policies and procedures, RoPA, DPIAs, privacy-by-design reviews, awareness sessions, internal audits and other agreed privacy governance activities.
Call to action
Talk to our market-leading technology consulting team to discuss appropriate operating models if your organisation is:
- Reviewing Bahrain PDPL obligations
- Considering appointing an external DPG
- Looking for ongoing privacy governance support
