Bahrain PDPL Incident Response: Guide for ERP Configuration

• Order 43 of 2022 Article 4: controllers must set procedures to notify the Authority of a breach within 72 hours of discovery, unless it would not affect data subjects' rights.
• Late notification to the Authority must be accompanied by justification for the delay; information may be supplied in phases without undue delay.
• Controllers must document every breach with its causes, effects and corrective measures, and give data subjects channels to report breaches.
• Data subjects need not be notified if data was unintelligible (e.g. encrypted), high risk is no longer likely, or effort is disproportionate (public communication instead).
• Order 43 Article 5 requires written internal investigation rules and preservation of evidence for the Authority or judicial bodies; Article 2(5) requires a continuity plan for sudden breaches.

• Add an incident register capturing discovery timestamp, 72-hour deadline countdown, causes, effects and remediation.
• Keep immutable audit logs and retain evidence for investigations.
• Capture Authority notice fields: nature, categories and approximate numbers of subjects and records, DPO contact, consequences, measures.
• Encrypt personal data at rest, which can remove the data-subject notification duty under Article 4(3)(a).

• Ministry of Justice, Islamic Affairs and Waqf Order No. (43) of 2022 (PDP Authority site)
• PDP Authority - Executive Decisions/Orders listing

Checked on 2026-10-09.

PDPL Incident Response affects how records are captured, approved and reported in your ERP. This guide lists the records involved and the controls worth putting in place.

The official rules come from Bahrain's Personal Data Protection Authority. We configure the system to what your adviser confirms.

• Incident log
• Affected records
• Response actions
• Notifications

Settings to review during implementation. Exact names differ by platform.

• Incident log
• Escalation contacts
• Evidence storage
• Review template

These are the mistakes we see most often when PDPL incident response is configured in an ERP system.

• Copying settings from another company without checking them
• Allowing manual journals or edits after the period is closed
• Leaving master data incomplete, then fixing it in reports
• No named owner for reviewing exceptions each month
• Not retesting after a system upgrade or rule change