---

title: "Bahrain Recording Laws: All-Party Consent Rules and Penalties (2026)" meta_description: "Bahrain requires all-party consent for recording under Cybercrime Law 60/2014 and the Penal Code. Learn penalties up to BHD 100,000, PDPL rules, and compliance steps." slug: "world-recording-laws/bahrain-recording-laws" categories: ["Recording Laws", "International Recording Laws"] keywords: ["bahrain recording laws", "bahrain wiretapping", "bahrain cybercrime law", "bahrain privacy law", "bahrain phone recording", "bahrain eavesdropping penalty", "bahrain PDPL", "bahrain all-party consent"] lastUpdated: "2026-03-21"

Bahrain Recording Laws: All-Party Consent Rules and Penalties (2026)

Bahrain is an all-party consent jurisdiction. Recording a phone call, face-to-face conversation, or electronic communication without the knowledge and agreement of every participant is a criminal offense under multiple overlapping statutes. The penalties are severe: the Cybercrime Law alone carries fines up to BHD 100,000 (roughly USD 265,000) plus prison time.

This guide covers the full legal framework governing recording and wiretapping in the Kingdom of Bahrain, including the Cybercrime Law, the Penal Code and its recent amendments, the Personal Data Protection Law, workplace and public surveillance rules, and what businesses operating in Bahrain need to know about compliance.

Constitutional Foundation: Article 26

Before diving into the specific statutes, it helps to understand where Bahrain's recording restrictions originate. Article 26 of the Bahrain Constitution states that "the freedom of postal, telegraphic, telephonic and electronic communication is safeguarded and its confidentiality is guaranteed."

Communications can only be intercepted or their confidentiality breached "in exigencies specified by law and in accordance with procedures and under guarantees prescribed by law." This constitutional provision underpins every statute discussed below. It establishes that privacy in communications is not just a regulatory preference but a fundamental right protected at the highest level of Bahraini law.

The Cybercrime Law: Law No. 60/2014

The most significant statute for anyone considering recording a phone call or intercepting electronic communications in Bahrain is the Law on Combating Information Technology Crimes, enacted as Law No. 60 of 2014.

Article 4: Wiretapping and Interception

Article 4 is the core provision. It criminalizes wiretapping, interception, eavesdropping, and the capturing of data transmitted between information technology systems. The offense covers any unauthorized act of listening to, recording, or capturing communications sent through electronic means.

The penalties are substantial. Anyone convicted under Article 4 faces imprisonment combined with a fine of up to BHD 100,000. At current exchange rates, that is approximately USD 265,000. The law does not distinguish between personal and commercial interception. Recording a single phone call without consent carries the same statutory penalties as large-scale corporate espionage.

Article 6: Aiding and Abetting

Article 6 extends criminal liability beyond the person who actually performs the interception. Anyone who aids the offender by providing tools, passwords, or similar information for the purpose of wiretapping or interception faces imprisonment of up to one year and a fine of up to BHD 100,000, or both.

This means that a person who provides recording software, shares login credentials used to access another person's communications, or otherwise facilitates illegal interception can be prosecuted even if they did not personally press the record button.

Categories of IT Crimes

The Cybercrime Law organizes offenses into three categories: crimes against IT systems (unauthorized access, system disruption), crimes involving the means of IT (using technology as the instrument of an offense), and content crimes (offenses related to the substance of communications). Wiretapping and interception fall primarily within the first two categories, depending on how the interception is carried out.

The Penal Code: Decree No. 15/1976

The Penal Code has served as Bahrain's primary criminal legislation since 1976. Several articles directly address recording, eavesdropping, and the disclosure of private information.

Article 370: Privacy and Unauthorized Surveillance

Article 370 addresses the unauthorized publication and disclosure of information that breaches an individual's privacy. Under the original 1976 text, the maximum penalty was six months in prison or a fine of just BHD 50. Legislators recognized for years that these penalties were outdated given the ease with which recordings can be made and shared through smartphones and social media.

Following years of parliamentary debate, the Bahraini Parliament passed Law No. 25 of 2025, which was published in the Official Gazette on May 29, 2025, and entered into force on May 30, 2025. The amended Article 370 now carries significantly stronger penalties for unauthorized audio or visual surveillance, recording private conversations without permission, and recording people in private settings without their knowledge.

Basic offenses under the amended Article 370 carry fines of BHD 500 to BHD 1,000 with possible imprisonment. If the recorded material is publicly shared or published, the fines increase to BHD 1,000 to BHD 3,000.

Article 354: Violations of Private and Family Life

Article 354 addresses broader violations of private and family life. Under the original text, the maximum penalty was three months in prison or a BHD 20 fine. Law No. 25/2025 increased these penalties to three to six months of imprisonment with fines of BHD 100 to BHD 1,000.

This article captures conduct that goes beyond recording itself, such as publishing details of someone's private life, even when those details are factually accurate, when the publication causes harm.

Article 372: Unlawful Disclosure of Messages and Calls

Article 372 specifically targets the unlawful disclosure of messages and calls. Under the original Penal Code, the fine was a mere BHD 20. The 2025 amendments transformed this provision:

For basic disclosure of private communications, the penalty is now BHD 500 to BHD 1,000, or imprisonment. For disclosures that harm third parties or involve matters of personal honor, the penalty rises to BHD 2,000 to BHD 5,000 in fines, plus prison time. In the most severe cases, offenders face up to five years in prison and a BHD 5,000 fine.

Legislative Decree No. 3/2025: Device Theft and Data Protection

Separate from the privacy amendments, Legislative Decree No. 3 of 2025 (enacted in January 2025) amended the Penal Code to address theft of electronic devices with intent to access their data. The amendments added new provisions to Articles 380 and 396.

Under the amended Article 380, theft of a mobile phone, laptop, tablet, or any electronic device "with the intent to obtain the information, data, or images that they contain" carries a minimum of one year imprisonment.

Article 396 now provides that seizing such devices to access their data carries penalties of up to two years imprisonment or a fine up to BHD 500, or both. These provisions complement the Cybercrime Law by addressing physical access to recorded communications stored on devices.

The Personal Data Protection Law: Law No. 30/2018

Bahrain's Personal Data Protection Law (PDPL), enacted as Law No. 30 of 2018 and enforced since August 1, 2019, adds another layer of regulation over recording activities. The PDPL is administered by the Personal Data Protection Authority (PDPA), an independent public body.

What Counts as Personal Data

Under Article 1 of the PDPL, personal data means "any information in any form concerning an identified individual, or an individual who can be identified" through identifiers or factors relating to their identity. A person's voice in a recorded conversation qualifies as personal data. So does any video footage in which a person is identifiable.

Consent Requirements

Article 24 of the PDPL requires that consent for data processing be "written, explicit, clear, and specific to the processing of certain data." The person providing consent must have full legal capacity, and the consent must be freely given after the individual understands the purposes and potential consequences.

This standard applies directly to recording. If you record someone's voice, you are processing their personal data, and you need their written, explicit consent unless a specific legal exception applies.

Surveillance Authorization

Article 15 of the PDPL requires that any automatic processing involving visual recording used for surveillance purposes receive prior authorization from the Personal Data Protection Authority. This applies to CCTV systems, security cameras, and any form of automated visual monitoring.

Biometric and genetic data processing also requires pre-authorization for automated operations, which is relevant for any recording system that uses voice recognition or facial recognition technology.

PDPL Penalties

The penalties under the PDPL are separate from and cumulative with those under the Penal Code and Cybercrime Law:

Criminal penalties include imprisonment of up to one year and fines of BHD 1,000 to BHD 20,000 for violations such as processing data without consent, processing without notifying the authority, or unauthorized sensitive data processing.

Administrative penalties include daily fines of up to BHD 1,000 for initial offenses and up to BHD 2,000 for repeat violations within three years, plus lump-sum fines of up to BHD 20,000.

For corporate offenders, the fines are doubled. A company that records calls without proper consent could face criminal fines of up to BHD 40,000 on top of any penalties under the Cybercrime Law and Penal Code.

Civil Liability

Article 58 of the PDPL grants individuals the right to seek civil compensation for damages resulting from unlawful data processing. A person whose conversation was recorded without consent can pursue both criminal charges and a separate civil claim for damages.

Phone Recording vs. In-Person Recording

Bahrain's legal framework treats phone recordings and in-person recordings with equal severity, but the applicable statutes overlap differently depending on the medium.

Phone and Electronic Communications

Recording a phone call falls squarely under Article 4 of the Cybercrime Law (Law No. 60/2014), which covers interception of data transmitted between IT systems. The Telecommunications Law (Decree-Law No. 48/2002) provides the regulatory framework for the telecoms industry and has been used by the Telecommunications Regulatory Authority (TRA) to mandate data retention by service providers.

For individuals, the rule is straightforward: you cannot record a phone call unless all parties to the call know about and agree to the recording. The same applies to video calls, voice messages, and any form of electronic communication.

In-Person Conversations

Recording a face-to-face conversation is governed primarily by the Penal Code (Articles 370 and 372, as amended) and the PDPL. The amended Article 370 specifically targets eavesdropping and recording in private settings without consent.

The expectation of privacy matters. A conversation between two people in a home or private office carries a strong expectation of privacy. Even a conversation in a semi-public setting, like a restaurant, may be considered private if the participants took reasonable steps to keep their discussion confidential.

Text Messages and Digital Communications

Written electronic communications are also protected. The Cybercrime Law covers the interception of any data transmitted between IT systems, which includes text messages, emails, and messaging app conversations. Accessing someone else's messages without authorization is prosecutable under the same framework.

Workplace Recording and Surveillance

Bahrain does not have a standalone workplace surveillance statute comparable to some European countries. Instead, workplace recording is governed by the intersection of the PDPL, the Penal Code, and general employment law.

Employer Obligations Under the PDPL

Any employer that records employees, whether through CCTV cameras, call monitoring systems, or other means, is processing personal data. The PDPL requires written, explicit consent from each employee before such processing begins. The employer must also notify the Personal Data Protection Authority of the processing activity.

Employers cannot broadly claim implied consent. The PDPL's standard demands specific, informed agreement from individuals who understand exactly what will be recorded, how the recordings will be used, and how long they will be stored.

CCTV in the Workplace

Employers installing CCTV cameras must comply with Article 15 of the PDPL, which requires prior authorization from the PDPA for surveillance using visual recording systems. Installations must also respect the privacy of areas where employees have a reasonable expectation of privacy, such as restrooms and changing areas.

Homeowners and businesses installing CCTV cameras must inform people about the presence of cameras, store captured data securely, use footage only for its stated security purpose, and refrain from sharing footage publicly without consent.

Employee Monitoring of Social Media

Monitoring employees' social media activity outside of work is not permitted under Bahraini law. While pre-employment background checks are allowed, ongoing surveillance of employees' personal online activities falls outside the scope of legitimate employment purposes.

AI and Automated Monitoring

There are no specific restrictions on how employers use AI for monitoring employee performance or productivity. However, any AI-based monitoring system that processes personal data must comply with the PDPL, including the consent and transparency requirements.

Recording in Public Spaces

Recording in public spaces in Bahrain occupies a legal gray area that depends heavily on what is being recorded and whether the recording captures private communications.

General Photography and Filming

Bahrain does not broadly prohibit photography or filming in public spaces. However, recording identifiable individuals without their consent implicates the PDPL, since the footage constitutes personal data. The amended Penal Code also criminalizes filming people in private or compromising situations without their knowledge, even if the filming occurs in a technically public location.

Filming Accident Victims

The 2025 Penal Code amendments (Law No. 25/2025) specifically addressed the practice of filming accident victims without consent. This is now a criminal offense, reflecting growing concern about bystanders recording vulnerable individuals and sharing the footage online.

Government and Military Locations

Recording near government buildings, military installations, and other sensitive locations is restricted. Bahrain's security laws prohibit unauthorized photography and recording in areas designated as security zones.

Criminal Penalties: Summary Table

Bahrain imposes penalties under multiple statutes. A single act of unauthorized recording can trigger prosecution under several laws simultaneously.

Offense	Statute	Penalty
Wiretapping or interception of electronic communications	Cybercrime Law Art. 4	Imprisonment + fine up to BHD 100,000
Aiding wiretapping by providing tools or passwords	Cybercrime Law Art. 6	Up to 1 year imprisonment + fine up to BHD 100,000
Secret recording or eavesdropping on private conversations	Penal Code Art. 370 (amended)	BHD 500 to BHD 1,000 fine + imprisonment
Public sharing of secretly recorded material	Penal Code Art. 370 (amended)	BHD 1,000 to BHD 3,000 fine + imprisonment
Unlawful disclosure of messages and calls	Penal Code Art. 372 (amended)	BHD 500 to BHD 5,000 fine + up to 5 years prison
Violations of private/family life	Penal Code Art. 354 (amended)	3-6 months prison + BHD 100 to BHD 1,000 fine
Theft of device with intent to access data	Penal Code Art. 380 (amended)	Minimum 1 year imprisonment
Processing personal data without consent	PDPL Art. 58	Up to 1 year prison + BHD 1,000 to BHD 20,000 fine
Corporate PDPL violation	PDPL Art. 59	Double the individual fine (up to BHD 40,000)

Cumulative Prosecution

These penalties are not mutually exclusive. A person who secretly records a phone call and shares it online could face charges under the Cybercrime Law (for the interception), the Penal Code (for the recording and disclosure), and the PDPL (for processing personal data without consent). The combined fines and prison terms can be devastating.

Business Compliance: Recording Calls in Bahrain

Businesses operating in Bahrain that need to record calls for quality assurance, compliance, or training purposes must navigate all three statutory frameworks simultaneously.

Step 1: Obtain Explicit Consent

Before any recording begins, secure written, explicit consent from all parties who will be recorded. For customer calls, this typically means playing a clear announcement at the start of the call that states the call is being recorded, the purpose of the recording, the legal basis, and how to decline. If a customer declines, you must provide an alternative service channel.

For employee calls, include recording consent provisions in employment contracts and internal policies. The consent must be specific, not buried in general terms and conditions.

Step 2: Notify the Personal Data Protection Authority

Under the PDPL, any organization processing personal data (including voice recordings) must notify the PDPA. If you are using automated surveillance systems, you need prior written authorization under Article 15.

Step 3: Implement Data Protection Safeguards

Recorded data must be stored securely, with access limited to authorized personnel. Establish a clear retention policy specifying how long recordings are kept. The PDPL's storage limitation principle means you cannot retain recordings indefinitely.

Step 4: Honor Data Subject Rights

Under the PDPL, recorded individuals have the right to request access to their recordings, request corrections or deletion, object to further processing, and request non-automated review of decisions made using their data. Businesses must respond to access requests within 15 working days, free of charge.

Step 5: Restrict Cross-Border Transfers

If your organization stores call recordings outside Bahrain, you must ensure the destination country provides "adequate legislative and regulatory protection" as determined by the PDPA, or obtain specific authorization for the transfer. Unauthorized cross-border transfer of recordings violates the PDPL.

Step 6: Appoint a Data Protection Coordinator

Organizations processing significant volumes of personal data should designate an internal data protection coordinator to manage compliance, respond to data subject requests, and liaise with the PDPA.

How Bahrain Compares to Its Neighbors

Bahrain's all-party consent requirement and heavy penalties place it among the stricter jurisdictions in the Gulf region.

United Arab Emirates also requires all-party consent. The UAE's Federal Decree-Law No. 34/2021 on Combating Rumors and Cybercrimes prohibits recording private conversations without consent, with penalties including imprisonment and fines up to AED 500,000.

Saudi Arabia criminalizes unauthorized recording under the Anti-Cybercrime Law (Royal Decree No. M/17, 2007). Recording private conversations or intercepting communications without consent carries up to one year imprisonment and fines up to SAR 500,000.

Kuwait has strict recording prohibitions under its Penal Code and Electronic Crimes Law. Unauthorized recording of private communications can result in imprisonment and fines.

Qatar prohibits unauthorized recording under the Cybercrime Prevention Law (Law No. 14/2014). Recording someone without consent in a private setting carries penalties of up to three years imprisonment.

For businesses operating across the Gulf Cooperation Council (GCC), the consistent theme is clear: all-party consent is the regional norm. Recording without consent in any GCC country carries serious criminal consequences.

Lawful Interception: When the Government Can Record

Bahrain's laws carve out exceptions for government surveillance conducted under lawful authority. The Telecommunications Law (Decree-Law No. 48/2002) requires telecommunications service providers to maintain a "lawful access capability plan" allowing security forces to access communications metadata when authorized.

Since 2009, the TRA has mandated that all telecommunications companies retain records of customers' phone calls, emails, and website visits for up to three years. This data retention requirement operates independently of the restrictions on private recording.

The PDPL specifically exempts processing related to public security carried out by the Ministry of Defense, Ministry of Interior, National Guard, National Security Service, or other security bodies in the Kingdom. This means that government security agencies operate under a different legal framework than private individuals and businesses.

Lawful interception by law enforcement requires proper authorization through the judicial system, consistent with the constitutional protections in Article 26.

Filing a Complaint

Legal complaints for unauthorized recording can only be filed by the victim, their legal guardian, or their heirs. The Public Prosecution may intervene in cases where no guardian exists or where conflicts of interest arise.

Victims can report cybercrimes, including unauthorized recording, to the General Directorate of Anti-Corruption and Economic and Electronic Security under the Ministry of Interior. For PDPL violations, complaints are filed with the Personal Data Protection Authority.

There is no mandatory reporting obligation for individuals or corporations who become aware of recording offenses. Reporting is voluntary.