Author: zubipartners_admin

Compliance and Accountability of Auditors

Auditors play a vital role in ensuring the transparency and integrity of companies. Shareholders entrust auditors to safeguard their interests and accurately report the company’s financial statements and internal controls.

This article will briefly outline the obligations and rights of auditors, shedding light on the general provisions of the Commercial Companies Law No. 21 of 2001, as amended (the “CCL”) and the common ground between Bahrain Shareholding Companies (“BSC”) and Partnerships Limited by Shares (“PLS”).

Auditors’ Obligations

The general objective of auditors is to perform an independent assessment of the company’s performance, through which the shareholders will significantly depend on their findings for decisions. Therefore, in addition to the External Auditor’s Law No. 15 of 2021, the CCL lists general reporting requirements and obligations.

Auditors of a BSC and PLS must attend general assembly meetings of the company and discuss the audit report with the shareholders. The audit report prepared must adhere to international auditing standards, and the CCL lists the main components as follows:

1. Whether the auditors obtained the information necessary to perform the audit.
2. Whether there are discrepancies between the balance sheet and the profit and loss account.
3. Whether the balance sheet and the profit and loss account were prepared in accordance with international accounting standards, or the standards approved by the authorities.
4. Whether the balance sheet and profit and loss account reflect the actual financial position of the company.
5. Whether the company maintained regular accounts.
6. Whether the company’s inventory was conducted in accordance with the recognized standards.
7. Whether the Board of Directors’ report is in conformity with the information contained in the company’s books.
8. Whether there are violations of the company’s Articles of Association or the provisions of law.

Furthermore, the auditors must provide the Ministry of Industry and Commerce (“MOIC”) with copies of the report and advise whether there are any violations or breaches of any nature.

Auditors’ Rights

The rights stipulated under the CCL empower auditors to fulfill their obligations with little to no hinderances from the company. Audit reports must be transparent regarding company violations; therefore, it is essential to authorize auditors and empower them to take action against the Board of Directors and the company’s employees if there is a lack of cooperation.

Considering the extensive obligations mentioned above, the CCL empowers auditors to access all the company’s books, registers and documents in order to fulfill their auditing duties. The auditors may ask for particular information or documentation necessary for the preparation of the audit report, whereby the CCL grants auditors the right to verify the company’s assets and liabilities.

If the company’s employees do not enable the auditors to exercise their rights under the law, the auditors may submit to the Board of Directors a report, through which the Board of Directors must facilitate the auditors’ tasks. If the Board of Directors is not cooperative, the auditors may invite the ordinary general assembly to decide on the matter.

Conflict of Interest

Auditors are appointed due to their independence and impartiality, which are crucial aspects to an accurate audit report. The CCL emphasizes the prohibition of appointing an auditor who is in conflict with the company and specifies the instances where a conflict of interest is present.

In accordance with the CCL, the appointed auditors must not be conflicted with the by holding the following positions:

1. Chairperson of the Board of Directors.
2. Member of the Board of Directors.
3. Managing Director.
4. Any administrative position.
5. Any supervisory position of the company’s accounts.

Moreover, the auditors may not be appointed if they have a relative (up to the second degree) that supervises the company’s accounts. During the auditing period, the auditors are prohibited from purchasing or selling shares of the company. This is to ensure that there is no insider trading considering that the auditor is privy to sensitive information during the audit period.

Auditors’ Liability

Due to the critical and sensitive nature of audit reports, the auditors are answerable for the accuracy of any information contained therein and may be liable to the company for damages sustained as a result of the inaccuracies of their reports. In the event there are multiple auditors who jointly participated in the inaccurate report, the auditors will be jointly liable to the company.

The statute of limitations regarding the liability of auditors is one year from the date of the general assembly meeting during which the auditor’s report was discussed. In the circumstance that the violation of the auditors was considered a criminal act, the claim against the auditors will not be heard before the judgment of the criminal case is issued.

Auditors’ liability may result in the right to compensation to shareholders and third parties as a result of non-compliance with accounting principles and standards, or professional wrongdoing.

In conclusion, to diligently examine company documents, financial statements and internal controls, an unbiased assessment is possible through the enforcement of the obligations, rights and liabilities of auditors as stipulated by law. The CCL governs auditors’ integrity, compliance and accountability to ensure that those characteristics are reflected in audit reports.

Basic Steps to Setting Up a Company in Bahrain

In Bahrain, establishing a company requires adherence to specific laws and regulations outlined by the Ministry of Industry and Commerce (MOIC) and, for banks and financial institutions, the Central Bank of Bahrain (CBB). This article outlines the fundamental steps involved in setting up a company in Bahrain, providing insights into the incorporation process, required documentation, and regulatory considerations.

This article will explain two types of commercial registrations: incorporating a company with or without a license application. These options and relevant details will be discussed, and the process can be initiated through the Sijilat portal.

Relevant Laws

• Law No. 21 of 2001, promulgating the Commercial Companies Law (CCL) and its amendments.
• Ministerial Order No. 6 of 2002, promulgating the Implementing Regulation of the Commercial Companies Law issued by Law No. 21 of 2001 and its amendments.
• Legislative Decree No. 7 of 1987, promulgating the Law of Commerce.
• Legislative Decree No. 27 of 2015 regarding the Commercial Registration Law and its amendments.
• Ministerial Order No. 126 of 2016, issuing the Implementing Regulation of Legislative Decree No. 27 of 2015 regarding Commercial Registration.

Considerations When Incorporating a Company

1. Company Type
   • What is the minimum capital required?
   • What is the proposed management structure?
   • What are the disclosure requirements?
2. Shareholders
   • How many shareholders are there, and what is their nature (corporate or individual?)
   • What are the nationalities of the shareholders?
3. Commercial Activities
   • What are the relevant commercial activities? Is only one activity required or more?
   • Are there any foreign ownership restrictions? Are there any restrictions on the company type?
   • What are the approvals, supporting documents, and special licenses required?
4. Licenses required (if any)
   • What documentation and information required for obtaining licenses?
   • What are the licensing conditions?
   • What are the applicable laws and regulations?

 Commercial Registration (CR) without License Application

Step 1: Submission of documents to the MOIC

Information:

1. 1. Proposed commercial name;
   2. capital amount
   3. total number of shares;
   4. distribution of shares amongst shareholders;
   5. new company’s director(s), email addresses, and mobile numbers (marital status, education, occupation if not a GCC national); and
   6. selected commercial activities.

•  Documents:

1. 1. Copies of passports/ identity cards of the new company’s directors;
   2. copies of passports/ identity cards of the new company’s authorised signatories; and
   3. if the shareholder(s) are:

Natural persons

1. 1. 1. A copy of each shareholder’s passport/ identity card, mobile, and email (marital status, education, occupation if not a GCC national); and
      2. A copy of the signed letter authorizing the professional body to submit the application (or notarized and ratified (where relevant if a submission is taken by a third party) Power of Attorney).

Juridical person

1. 1. 1. Copies of the ratified commercial registration and constitutional documents; and
      2. original resolution approving the setup of the new company duly ratified and notarized (if relevant).

Step 2: Security clearance approval by Nationality, Passports & Residence Affairs (NPRA)

Step 3: MOIC Approval

Step 4: Payment of application fees

Commercial Registration (CR) with License Application

Step 1: UBO & Commercial Address

• • Details of Ultimate Beneficial Owner(s) (UBO): name, mobile, email address, Tax Identification Number (TIN), Proof of TIN and UBO Declaration of each UBO;
  • copy of the signed lease agreement for the new company’s office in Bahrain;
  • copy of the address card;
  • pictures of the leased offices from the inside and outside of the address plate;
  • copy of any document showing that an Electricity and Water Authority (EWA)/ Municipality Account was opened by the new company;
  • termination letter of the previous tenant;
  • evidence that the lease agreement was registered at bh; and
  • resubmit CR WO/License Documents.

Step 2: Licensing Entity Approval

• • Submitting the documents required by licensing entities.

Step 3: Obtaining Municipality Affairs preliminary approval

Step 4: Obtaining licensing entities’ preliminary approval

Step 5: Final Municipality Affairs approval (where relevant)

Step 6: MOIC approval of Constitutional Documents

• • Submitting the draft constitutional documents of the new company.

Step 7: Notarization of Constitutional Documents

• • Know Your Customer (KYC) form;
  • original notarized authority document of any representative signatory; and
  • identity card/ passport of the signatory.

Step 8: Capital Certificate

• • Capital certificate from the bank evidencing the deposit of the new company’s share capital; and
  • notarized constitutional documents.

Step 9: Final site approval by licensing entities

Step 10: Final MOIC approval

Step 11: Payment of application fees 

Establishing a company in Bahrain involves a meticulous process governed by a set of laws and regulations. Each step requires careful attention to detail and compliance. By following the outlined steps and ensuring the submission of required documents, entrepreneurs can navigate the incorporation process smoothly, paving the way for a successful venture in Bahrain’s vibrant business landscape.

Contact us at Zu’bi and Partners to directly assist you in setting up your company in Bahrain. Our dedicated team is committed to guiding you through the entire process, ensuring compliance with all legal requirements.

Disputes With Employees Under Bahraini Labour Regulations  

Introduction: Under the Labour Law, it is crucial for employers to adhere to legal frameworks when addressing disputes with employees. This article aims to provide insights into handling various employment-related conflicts, with a specific focus on termination disputes. By understanding the legal obligations and resolution mechanisms, employers can navigate disputes effectively while upholding the rights of both parties.

1. Legal Framework for Termination Procedures: Termination of employment in Bahrain must adhere to specific procedures outlined in the Labour Law. Employers must ensure compliance with statutory requirements regarding notice periods, severance pay, and other entitlements. Failure to follow these procedures may result in legal repercussions for the employer.
2. Handling Termination Scenarios:

• Termination of Service Without Cause: Employers must provide a valid reason for terminating an employee’s service. However, if termination occurs without cause, the employee may be entitled to compensation as per the Labour Law. Employers should document the reasons for termination to defend against potential disputes.
• Termination Without a Legitimate Reason: Terminating an employee without a legitimate reason can lead to disputes and legal challenges. Employers should ensure that terminations are based on valid grounds such as poor performance, misconduct, or redundancy, as defined by the Labour Law. 
  
  Pursuant to Article 106 of the Labour Law, the employee may terminate the labour contract following the employer’s notification in any of the two following events:
  • The violation by the employer of an essential obligation specified by virtue of the law, the labour contract, or the work regulations at the establishment;
  • If the employer or his representative deceives the employee as to the working conditions or circumstances, when said, deception is so serious to the extent that otherwise the labour contract would not have been concluded.

Before sending the notice of termination of the labour contract, the employee must request, in writing, the employer to remedy the violation or deception within a time limit not exceeding thirty days from the date of submittal of the request. If said time limit elapses without any response by the employer to said request, the employee shall have, after sending the abovementioned notice, the right to terminate the labour contract.

Such termination of the labour contract shall be deemed lacking a legitimate reason by the employer if the employee’s allegations are evidenced.

• Termination by Unlawful Dismissal: Arbitrary dismissal, where an employee is terminated unfairly or without due process, is prohibited under the Labour Law. Employers must provide employees with a fair opportunity to contest the termination and present their case.

 In the context of the Labour Law, specific criteria have been outlined to determine cases of arbitrary dismissal. Article 104 of the Labour Law delineates six exclusive cases that qualify as arbitrary dismissal.

These cases are as follows:

• • The employee’s sex, color, religion, ideology, marital status, family responsibilities, or the female employee’s pregnancy, delivery of a child, or breastfeeding;
  • If the employee is affiliated with any employee trade union or participates legitimately in any of its activities in accordance with the laws and by-laws;
  • If the employee represents employees in a trade union association, has already enjoyed said capacity or seeks to do so;
  • If the employee submits a complaint or formal notice or instigates an action against the employer, unless the complaint, formal notice, or action is of a vexatious nature;
  • If the employee exercises his right to take a leave in accordance with the provisions of the Labour Law;
  • The garnishment of the employee’s entitlements with the employer.

The important question often posed is whether there is any difference regarding the compensation granted in the case of termination of service without cause or without a legitimate reason in the case of unlawful dismissal.

The answer has been clarified in Article No. 111 of the Labour Law as follows:

1. 1. If the employer terminates the indefinite-term employment contract within the first three months from the date of commencement of work, the employee is not entitled to any compensation unless the termination constitutes arbitrary dismissal pursuant to the provisions of Articles 104 and 105 of the Labour Law. In this case, the employee is entitled to compensation equivalent to one month’s salary.
   2. If the employer terminates the indefinite-term employment contract without cause or for unjustifiable reasons after the expiration of three months from the date of commencement of work, he shall compensate the employee with an amount equivalent to two days’ salary for each month of service, not less than one month’s salary and not exceeding twelve months’ salary.
   3. If the employer terminates the fixed-term employment contract without cause or for unjustifiable reasons, he shall compensate the employee with an amount equivalent to the salary for the remaining duration of the contract, unless the parties agree on a lesser compensation, provided that the agreed compensation does not amount to less than three months’ salary or the remaining duration of the contract, whichever is less.
   4. If the employer terminates the contract concluded for the completion of a specific task without cause or for unjustifiable reasons, he shall compensate the employee with an amount equivalent to the salary for the remaining and necessary period to complete the agreed-upon task, according to the nature of the work, unless the parties agree on a lesser compensation, provided that the agreed compensation does not amount to less than three months’ salary or the remaining and necessary period to complete the work, whichever is less.
   5. In the cases stipulated in paragraphs (A) and (B) above, if the termination of the contract constitutes arbitrary dismissal pursuant to the provisions of either Article 104 or 105 of the Labour Law, the employee shall be entitled to additional compensation equivalent to half of the compensation due pursuant to the provisions of above, unless the contract provides for compensation exceeding that.
   6. For the purposes of the above calculations, fractional months shall be considered as complete months

3. Subsequent Disputes Over Labour Entitlements: Disputes may arise regarding labour entitlements post-dismissal, including severance pay, end-of-service benefits, and outstanding dues. Employers should maintain clear records of employment contracts, salary payments, and any agreements related to entitlements to resolve such disputes efficiently.

 Further to Article 110 of the Labour Law:

The employer may terminate the labour contract as a result of the total or partial closure of the establishment, the downsizing of its activities, the replacement of the production system by another in a way that affects the number of the workforce, provided the contract is only terminated following the notification of the Ministry of Labour of the reason of termination thirty days before the date of notification of the employee of the termination.

The employee shall be entitled in case of termination of the labour contract for any of the reasons specified in the previous paragraph to compensation equivalent to half the compensation specified in Article 111 of the Labour Law.

Article 47 of the Labour Law:

The employee’s rights related to the end of service indemnity and the compensation for the annual leave balance specified in Article 59 as well as the compensation due in accordance with the provisions of Article 99(b) and Article 111 of the Labour Law, shall be calculated on the basis of the last basic wage of the employee in addition to the social gratuity if any. If the employee is employed by piecework or per production or receives a fixed wage plus a commission or percentage, the average wage of the employee during the last three months shall be retained in the calculation of these rights.

4. Resolution Mechanisms: Employers and employees can resolve disputes through various mechanisms, including mediation, arbitration, or litigation. These mechanisms offer alternative avenues for resolving conflicts outside of the formal court system, promoting faster and more cost-effective solutions.

• • Arbitration: Pursuant to Article 119 of the Labour Law, the Authority for Settlement of Individual Labour Disputes (the “Authority”) was formed to be in charge of the amicable settlement of any individual labour dispute submitted to it between the employee and the employer with the approval of both parties before resorting to the judiciary.

If the dispute is settled, the Authority shall draft minutes to be signed by the parties to the dispute or their representatives and the competent civil-servant, and such minutes shall have the power of an executive bond.

In accordance with the provisions of Chapter Fourteen of the Labour Law concerning collective labour relations, requests for collective labour disputes are forwarded to the Trade Union Affairs Department of the Ministry of Labour by employee groups or union organizations, who are then encouraged to mediate the issues amicably before filing a formal complaint  to the Ministry of Justice, Islamic Affairs, and Endowments’ Collective Arbitration Panel or the Collective Labour Disputes Settlement Council.

• • Litigation: Labour disputes are initially brought before the Labour Lawsuit Department of the Ministry of Labour as a requisite preliminary step prior to formal litigation. In the event that an amicable resolution proves elusive, the matter is subsequently escalated to the esteemed jurisdiction of the High Labour Court for adjudication.

The labour action shall be subject to the statute of limitation of the expiry of one year from the date of expiry of the labour contract.

Pursuant to Article 136 of the Labour Law. The above statute of limitation shall not apply to actions related to the infringement of commercial or industrial secrets or the implementation of the provisions of the labour contract aiming at ensuring the observance of these secrets.

In conclusion: As outlined in this article, strict adherence to the Labour Law’s provisions ensures that employers fulfill their legal obligations while safeguarding the rights of both parties involved. By embracing mediation, arbitration, or litigation as viable avenues for dispute resolution, employers can foster equitable and efficient mechanisms for addressing conflicts, thereby promoting a harmonious and legally compliant work environment. This proactive approach not only mitigates legal risks but also upholds the principles of fairness and justice in the employer-employee relationship, ultimately contributing to the overall stability and prosperity of businesses operating in Bahrain.

Choosing the Right Form of Business

In the Kingdom of Bahrain, any business established within the territory must be registered with the Ministry of Industry and Commerce (“MOIC”). The types of business vehicles chosen by a company determine (i) the set of regulations applicable, (ii) the business activities permissible and (iii) its freedoms or restrictions. Therefore, picking the right kind of business vehicle is critical to the future of any company.
There are 6 types of business vehicles in Bahrain, which are (i) General Partnership Company, (ii) Limited Partnership Company, (iii) Joint Venture Company (iv) Shareholding Company (v) Limited Liability Company, and (vi) Partnership Limited By Shares.
This article will briefly summarize the business vehicles in Bahrain, where certain limitations and restrictions of each vehicle will be outlined.

1. GENERAL PARTNERSHIP COMPANY

A General Partnership Company (“GPC”) has a minimum of two partners who share joint liability to the extent of their personal assets. Therefore, if a GPC files for bankruptcy, undergoes liquidation or is winding down, the court may order the repayment of debts from the partner’s personal funds.

GPCs are limited by the law in terms of naming the company, where it must consist of the names of all the partners or the name of one partner with the addition of ‘& Co.’. This restriction is mandatory and holds great significance under the law to ensure that the names of the partners are disclosed to the public and hence the extent of their liability. In the circumstance that a non-partner’s name is added to the name of a GPC with their knowledge, the non-partner is also jointly liable with the partners of the GPC.

The constitutional documents of a GPC consist of a Memorandum of Association (mandatory to all GPCs) and the Articles of Association (may be drawn up by the GPC and subsequently notarized by a Public or Private Notary). The Memorandum of Association must consist of (but is not limited to) the following:

1. The company’s name, objective, head office and branches, if any.
2. The partners’ names, domiciles, occupations and nationalities.
3. The company’s capital, a sufficient indication of the share each partner has undertaken to provide the company and their respective dates.
4. The names of the managers and authorized signatories.
5. The date of the company’s incorporation and its duration.
6. The beginning and end of its financial year.

2. LIMITED PARTNERSHIP COMPANY

A Limited Partnership Company (“LPC”), also known as Simple Commandite Company, is comparable to a GPC in terms of the provisions under the Commercial Companies Law (“CCL”). There are various provisions under the CCL applicable to GPCs and LPCs alike.

However, a significant difference between LPCs and GPCs is the limited liability to a certain type of partner. ‘Sleeping partners’ that do not undertake the management of the company and investment capital in the company are not liable for the company’s obligations to the extent of their assets; sleeping partners are only liable to the extent of their invested capital (similar to companies with limited liability as outlined below). Conversely, partners that manage the company are jointly and severally liable for the company’s obligations where their personal assets may be affected by the company’s debts, liquidation etc.

The names of all partners of an LPC, including sleeping partners, must be included in the Memorandum of Association.

3. JOINT VENTURES

A Joint Venture Company (“JVC”), also known as an Association in Participation, is a type of business vehicle that is different from other companies as it is not considered a legal person or juristic entity and is not subject to the usual publication procedures.

In general, JVCs are established when two or more entities are joined into a new entity to accomplish a specific task, where the entities agree to pool their resources to achieve their agreed upon aims.

Since a JVC is not considered an independent legal person, third parties cannot have a legal relationship with a JVC, therefore contracts and transactions cannot be concluded in the name of a JVC. The partner entities in a JVC share profits, losses, risks and liabilities with third parties in accordance with the agreement made between the partner entities. Regardless, a Memorandum of Association may be established by the partner entities.

4. SHAREHOLDING COMPANY

A Bahrain Shareholding Company (“BSC”) has negotiable shares whereby a number of legal or natural persons may be subscribed. Similar to WLLs, the shareholders are only liable for the company’s debts to the extent of the value of their shares. There are two types of BSCs; public and closed.

Public BSCs are companies that are listed on Bahrain Bourse, the capital market of Bahrain, and whose published shares are traded openly. Any legal or natural person may purchase or sell publicly listed shares through brokers licensed by the Central Bank of Bahrain and Bahrain Bourse (also known as trading members). On the other hand, closed BSCs are not open to the public for subscription, and shares of closed BSCs may be transferred via share purchase agreements.

Restrictions regarding BSC commercial names include the prohibition of deriving the name from a natural person unless (i) the company’s objective is patented and legally registered under the name of that person or (ii) the company acquired a business and adopts its name. Similar to a WLL, a BSC must include the phrase ‘Bahrain Shareholding Company’ following its name.

The Memorandum of Association, a preliminary constitutional document of BSCs, must be drawn with the following details:

1. The company’s name.
2. The company’s head office.
3. The objectives for which it has been incorporated.
4. The names of the promoters, provided that their number shall not be less than two, except for companies incorporated exclusively by the government.
5. The authorized and issued capital, the paid capital on incorporation and the number of shares into which the capital is divided.
6. The company’s term, if any.
7. Details about each in-kind share, and all conditions related to the contribution of such share, the name of the person contributing it and the real rights attached to such share.
8.  An approximate estimate of the expenses, wages and costs the company has paid or undertakes to pay in the course of its incorporation.

5. LIMITED LIABILITY COMPANY

A Limited Liability Company (“WLL”) is established with one or more legal or natural persons (i.e., companies or individuals). In contrast to a GPC, a WLL limits the liability to the company’s assets and each partner is liable only to the extent of his/her share in the capital. Companies previously known as ‘Single Person Company’ (“SPC”) have changed to WLL companies since the provisions governing SPCs were repealed through Resolution No. 28 of 2020 amending certain provisions of the CCL.

The restriction regarding the name of WLL companies is the addition of the phrase ‘with limited liability’ following its name. Similarly to the rationale of GPCs, this restriction ensures that the public is aware of the type of company prior to entering into transactions or agreements. In the circumstance that the phrase is not included in WLL’s contracts, invoices, notices, documents or publications, the company’s managers will be jointly liable towards third parties.

The Memorandum of Association must include (but is not limited to) the following:

1. Names, surnames and nationalities of the partners.
2. The company’s head office.
3. The company’s name and address, with the phrase ‘limited liability company’ added to it.
4. The objects for which the company was established.
5. The company’s capital and the cash or in-kind shares provided by each partner, with an accurate description of the in-kind shares and the value thereof.
6.  Conditions pertaining to assignment of shares.
7. The company’s term, if any.
8. The names of those with which the company’s administration has been entrusted, from amongst partners or non-partners, if any, and the names of the supervisory council members in the cases where such council is required by the CCL.
9. The method of distribution of profits and losses.

6. PARTNERSHIP LIMITED BY SHARES

A Partnership Limited by Shares (“PLS”), also known as Commandite By Shares Company, is similar to an LPC and BSC where it consists of two categories of partners; joint partners (liable to the extent of their personal assets) and shareholding partners (liable to the extent of their equity in the capital).
The capital of a PLS is divided into negotiable and indivisible shares, both of equal value, where shareholding partners and their shares in a PLS are subject to the same provisions of a BSC under the CCL (unless there are conflicting provisions). A PLS must assemble its joint and shareholding partners in annual and extraordinary general meetings, of which the provisions of closed BSCs apply.
The name of PLS companies must consist of one or more of the joint partners or can be derived from the company’s objectives. Similar to LPCs, if a shareholding partner’s name is added to the official name of a PLS (with his/her knowledge), then the shareholding partner will be considered a joint partner.
The form of business vehicles is a significant determinant of a company’s future. The decision to choose a type of vehicle depends greatly on the company’s objectives, business activity, and its financial capability. Moreover, the publicly available database, Sijilat, created by the Ministry of Industry and Commerce lists registered businesses in Bahrain and all business activities available

Navigating Data Transfer: List of Whitelisted Countries

In an age where digital connection and global information exchange dominate our lives, protecting personal data has become a top priority for individuals, companies, and governments alike. Law No. 30 of 2018 promulgating the Personal Data Protection Law (the “PDPL”) is Bahrain’s principal statute on personal data protection. The PDPL is intended to safeguard people’s privacy and security by requiring the lawful processing of personal data.

This article delves into Bahrain’s intricate framework of data transfer regulations, concentrating on nations exempt from the express consent requirement for the transfer of data outside Bahrain. It will analyze the PDPL and the accompanying resolutions to offer clarification on the whitelisted countries as well as the processes for obtaining consent to transfer data for countries that are not on the list.

The PDPL protects several forms of personal data, including sensitive information like biometrics and health records. It establishes fundamental concepts such as openness, fairness, purpose restriction, data reduction, accuracy, storage limitation, and security.

The PDPL applies to Bahraini citizens or workers, locally created firms, and enterprises outside Bahrain that handle personal data “by means available in Bahrain.” Non-Bahraini enterprises that operate data centers or use third-party data processors in Bahrain will fall within the scope of the PDPL.

Resolution No. 42 of 2022 (the “Resolution”) sets out 83 countries as approved for the transfer of personal data outside Bahrain without the express consent of the data subject or the specific authorization of the Personal Data Protection Authority (the “PDPA”). The whitelist indicates that certain countries have satisfied the criteria of the PDPA and removed extra regulatory approval requirements for transmitting personal data from Bahrain.

Transferring personal data to a country that is not on the whitelist requires getting authorization from the PDPA. Nonetheless, the transfer must be subject to the condition that the data subject’s consent has been acquired or that there is a contractual or legal duty to transmit the data. This need also applies to transfers of personal data within a group and those that take place under the terms of a contract with a third party. When asking for permission to transfer to non-whitelist countries, data managers must provide a copy of the contract to the PDPA for approval.

The approved list of countries is as follows:

SR NO	COUNTRIES	SR NO	COUNTRIES
1.	Andorra	43.	Kingdom of Saudi Arabia
2.	Argentina	44.	Kuwait
3.	Australia	45.	Latvia
4.	Austria	46.	Liechtenstein
5.	Belgium	47.	Lithuania
6.	Bolivia	48.	Luxembourg
7.	Brazil	49.	Macau
8.	Brunei	50.	Malaysia
9.	Bulgaria	51.	Malta
10.	Canada	52.	Mexico
11.	Chile	53.	Monaco
12.	China	54.	Morrocco
13.	Colombia	55.	Netherlands
14.	Croatia	56.	New Zealand
15.	Cyprus	57.	Nigeria
16.	Czech Republic	58.	Norway
17.	Denmark	59.	Oman
18.	Ecuador	60.	Pakistan
19.	Egypt	61.	Paraguay
20.	Estonia	62.	Peru
21.	Falkland Islands	63.	Poland
22.	Faroe Islands	64.	Portugal
23.	Finland	65.	Romania
24.	France	66.	Russia
25.	French Guiana	67.	San Marino
26.	Georgia	68.	Singapore
27.	Germany	69.	Slovakia
28.	Greece	70.	Slovenia
29.	Guernsey	71.	South Korea
30.	Guyana	72.	Spain
31.	Hong Kong	73.	Suriname
32.	Hungary	74.	Sweden
33.	Iceland	75.	Switzerland
34.	India	76.	Thailand
35.	Ireland	77.	Ukraine
36.	Isle of Man	78.	United Arab Emirates
37.	Israel	79.	United Kingdom
38.	Italy	80.	United States of America
39.	Japan	81.	Uruguay
40.	Jersey	82.	Vatican
41.	Jordan	83.	Venezuela
42.	Kazakhstan

 

According to the Resolution, certain data controllers are entitled to transmit personal data to countries with insufficient data protection under specific situations. These conditions include the following:

Case-by-case authorization: The PDPA can provide authorization for data transfers on an individual basis while verifying that the data is sufficiently safeguarded.

Data Subject Consent: Data transfers are permitted if the data subject has explicitly consented to the transmission of their personal information.

Extracted from Public Register: Data from a public register established under the PDPL may be transmitted, subject to compliance with certain terms and restrictions for accessing the register.

Transfers are permitted for specified purposes: such as executing a contract between the data subject and the data controller.

If the transfer is necessary for:

• The performance of a contract with a third party to benefit the data subject.
• Safeguarding the data subject’s vital interests.
• Complying with PDPL requirements, not being a contractual commitment, or complying with competent authority directives (e.g. court, public prosecution, investigative judge or military prosecution).
• Preparing, executing, or defending legal claims.

Bahrain’s use of a whitelist for data transfers differs from the General Data Protection Regulation’s uniform approach to cross-border data flows. This adaption reflects Bahrain’s commitment to aligning global standards with its own legal setting while respecting the essential pillars of international data protection standards. 

Protection in Cyberspace: Cybersecurity Risks and Regulations

Cybersecurity adoption has become a priority for countries and companies worldwide. Regulations, guidelines, and template policies are issued to ensure the protection of data and minimize the effects of cyberattacks. Since cyber threats are increasing, the lack of security in cyberspace heightens the risk of fraud, ransomware, misrepresentation, and exploitation. Therefore, companies and nations alike must understand the risks associated with cyberspace along with the methods of avoiding and mitigating its detrimental effects.

In this article, the basics of cybersecurity and regulations issued in Bahrain will be explained.

Cybersecurity and Cyberattacks

In a nutshell, cybersecurity is protection against cyberattacks or threats that may potentially change, destroy, or exploit sensitive information. The widespread issue of ransomware, through which money is extorted or business is halted, requires robust solutions that integrate cybersecurity and avoid the potential for cyber threats.

While cybersecurity is a trending topic today, the field of cybersecurity originated in 1987, when anti-virus software was the only barrier between users and the loss of their data. In 2020, an increase in cyberattacks was reported by the World Health Organization (WHO) during the pandemic, where 450 email addresses and passwords were leaked online, leading scammers to fairly easy methods of exploitation and fraud. During that stage, anti-virus software had little significance whereas avoiding fraudulent emails and awareness were the key. Since cyberattacks are ever-evolving, and technology is advancing, it is an endless cycle of potential threats and reinforcing new security methods.

Avoiding and Mitigating Risks

For the time being, there are a variety of effective cybersecurity solutions available to avoid and mitigate cyber risk. The National Cyber Security Center (NCSC) issued regulations, guidelines, and programs that can be utilized by individuals, companies, and governmental entities.

The Baseline Cyber Security Controls (Baseline Controls) must be mandatorily complied with by private and public entities alike, specifically within Critical National Infrastructure sectors (CNI). CNI’s include Gas, Electricity & Oil (GEO), Financial Services, Information and Communications Technology (ICT), Health Services, Government Services, Critical Industry, and Transportation. Since the Baseline Controls have comprehensive and effective provisions, the NCSC encourages all companies to adopt its provisions regardless of the sector.

Moreover, the NCSC provides policy templates for cybersecurity policies integrating global best practices. The NCSC advised taking into account the company’s cyber risk assessment when adopting the policy templates. Essential templates regarding data backup, email security, incident response, encryption, and risk management, to name a few, are available on the NCSC website.

The Cyber Trust Program is designed to raise awareness among employees and enhance risk protection from cyberattacks. There are four levels of maturity in the program, (i) Practitioner Level, (ii) Progressive Level, (iii) Professional Level, and (iv) Expert Level. Each aims to improve and evaluate the levels of cybersecurity in order to strengthen companies of all  sizes

On a national level, the National Cybersecurity Risk Management Framework was issued to unify the government’s risk management methodology to integrate a center for internet security in its practices. Bahrain has also adopted the Cloud-First Policy which pushes for the adoption of cloud-based services when undertaking all ICT procurements.

Concluding Note

The first step to strengthening protection in cyberspace is the continuous awareness of the ever-evolving cyber risks and adopting reliable and effective tools publicly available. In a rapidly evolving landscape, prioritizing cybersecurity is no longer an option – it is a necessity.

 

Regulating Telemedicine in Bahrain

Following the pandemic, our everyday routines experienced a significant shift. We transitioned to remote work, home workouts, and staying in, trying to minimize in-person interactions whenever possible. Consequently, this shift has impacted various aspects of our lives, including work, education, socialization, and even healthcare. Medicine is one of the fields that had a major shift. Telemedicine has surfaced as a prominent solution, allowing individuals to receive remote consultations, prescriptions, and medical services easily. Telemedicine can be defined as using telecommunications technologies to support the delivery of all kinds of medical, diagnostic, and treatment-related services by doctors. Telemedicine was limited before the pandemic, held back by regulatory barriers and hesitation from patients and providers. There is a growing importance of telemedicine globally as the preferred method of healthcare delivery; therefore, governments have been compelled to adapt by implementing regulatory laws and guidelines.

Regulatory Framework in Bahrain

In Bahrain, the governing bodies have introduced a series of decisions, procedures, and guidelines aimed at regulating the use of telehealth services. These regulations include but are not limited to the following:

• Legislative Decree No. 20 of 2015 amending Legislative Decree No. 18 of 1997 relating to the Organization of the Pharmacy Profession and Pharmaceutical Centers;
• Resolution No. 63 of 2019 relating to Requirements and Procedures for Practicing Pharmacy Professions and Licensing of Pharmaceutical Facilities;
• Supreme Council of Health’s Resolution No. 2 of 2019 relating to the Technical and Engineering Requirements of Healthcare Facilities;
• National Health Regulation Authority (“NHRA”) Guidelines on the Health Requirements, Technical Standards, and Safety Requirements to be available in the premises and fittings of Healthcare Facilities (2019);
• NHRA Telemedicine Dispensing Procedure (2020); and
• NHRA Telemedicine Dispensing Procedure (2023).

Telemedicine Guidelines

Telemedicine is permitted per NHRA. NHRA initially issued a Telemedicine Dispensing Procedure in May 2020 during the pandemic, followed by an updated version in June 2023 (“Guidance”), which aims to act as a practical guide to licensed medical practitioners in public and private pharmacies, encouraging them to incorporate telemedicine in their regular practice. This article provides a brief overview of the recent NHRA Telemedicine Dispensing Procedure (2023). The Guidance outlines the procedures, prescription requirements, and permissible medications for telemedicine consultations.

Benefits of telemedicine

Telemedicine is not aimed at replacing in-person visits. However, it seeks to reduce the burden on hospitals. It comes in handy in cases where physical interaction with a medical professional is not necessary, such as regular check-ups and continuous monitoring. Telemedicine has several advantages, including but not limited to cost savings, convenience such as reduced waiting time for consultations, and the ability to provide care to people with mobility limitations such as those in rural areas or those who do not have access to a local doctor. Most importantly, it prevents the transmission of infectious diseases to providers and patients.

Procedure:

As per the Guidance, medical licensed practitioners may prescribe medicines via telemedicine only when they are satisfied that they have gathered adequate information about the patient’s medical condition and that it is in the patient’s best interest. Prescribing medicines without an appropriate diagnosis/provisional diagnosis will amount to professional misconduct.

The Guidance categorizes medications into three lists:

1. List P (Pharmacy only): commonly used medicines for common conditions and medications necessary during public health emergencies.
2. List POM (Prescription-only medicines): can be prescribed during the first telemedicine consultation and for follow-up purposes. The list comprises relatively safe medicines with low potential for abuse.
3. Prohibited List: high potential for abuse, such as narcotics and psychotropic substances, cannot be prescribed via telemedicine.

Prescription Requirements:

To ensure accountability and patient safety, the Guidance specifies mandatory components of a prescription, including the name, specialty, and contact details of the prescribing doctor, as well as the patient’s name and ID number. The doctor must sign and stamp the prescription and include the prescription date.

Issuing a Prescription:

Licensed medical practitioners are required to issue prescriptions in compliance with NHRA policies and regulations. They may provide a photo, scan, digital copy, or e-prescription to the patient via email or any messaging platform.

In conclusion, Bahrain has witnessed significant regulatory updates with the introduction of specific laws, guidelines, and procedures by governing bodies such as NHRA. Telemedicine has become a viable and regulated option for healthcare delivery in the country. As telemedicine continues to evolve and integrate into the healthcare landscape, it is expected to play an important role in providing efficient and accessible healthcare services in Bahrain.

If you require more information on compliance requirements for healthcare providers offering telemedicine services and to avoid any legal implications, we recommend contacting one of our experienced lawyers who can assist.