Legislative Decree No. 56 of 2018
In Respect of Providing Cloud Computing Services to Foreign Parties

We, Hamad bin Isa Al Khalifa,               King of the Kingdom of Bahrain,

• Having perused the Constitution, particularly Section 38 thereof;
• The Civil and Commercial Procedure Law promulgated by Legislative Decree No. 12 of 1971 (as amended);
• The Law of Evidence in Civil and Commercial Matters promulgated by Legislative Decree No. 14 of 1996 (as amended);
• The Judicial Authority Law promulgated by Legislative Decree No. 42 of 2002 (as amended);
• The Criminal Procedure Law promulgated by Legislative Decree No. 46 of 2002 (as amended);
• Law No. 60 of 2014 in respect of Information Technology Crimes;
• Law No. 6 of 2015 in respect of Conflict of Laws in Civil and Commercial Matters Involving a Foreign Element;
• Law No. 2 of 2017 Ratifying the Arab Convention for Combatting Information Technology Crimes;
• Data Protection Law Promulgated by Law No. 30 of 2018;
• Upon tabling by the Prime Minister; and
• Upon approval of the Council of Ministers;

We decreed the following:

Section 1
Definitions

For the purposes of this law, the following words and expressions shall have the meaning assigned opposite each unless the context requires otherwise:

1. ‘Kingdom’ means the Kingdom of Bahrain;
2. ‘Cloud Computing’ means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or Service Provider interaction.
3. ‘Cloud Computing Contract’ means an agreement entered into between a Service Provider and a Customer concerning the provision and use of a Cloud Computing Service;
4. ‘Cloud Computing Service’ means information and communications technology services provided through Cloud Computing, which include, but are not limited to, infrastructure as a service, platform as a service and software as a service offerings made available to a Customer through the use of Cloud Computing;
5. ‘Service Provider’ means any provider of Cloud Computing Service to the public through any Data Centre;
6. ‘Customer’ means any Foreign Party that has entered into a Cloud Computing Contract with a Service Provider;
7. ‘Customer Content’ means software (including machine images), data, text, audio, video, or images that a Customer or its end users transfer to the Service Provider for storage and/or use for Cloud Computing Services. Customer Content also includes any computational results that a Customer or its end users derive from the Cloud Computing Service through its use of such Cloud Computing Services;
8. ‘Data Centre’ means any data centre designated under section 4 of this law that is physically located in the Kingdom and which provides Cloud Computing Services to Customers;
9. ‘Foreign Party’ means any entity that is validly existing under the law of a Foreign Sate, including any public or private juridical person established or constituted in a Foreign State and any government or non-government entity of a Foreign State; and
10. ‘Foreign State’ means any foreign state, including where applicable any of its territorial units which has its own laws, designated under section 4 of this law.

Section 2
Purposes of the Law

The purposes of this law is to provide a legal framework that encourages Foreign Parties use of and investment in Cloud Computing Services within Data Centres.

Section 3
Jurisdiction over Customer Content

1. Subject to paragraph (4), the Customer Content shall be subject to the exclusive jurisdiction of the competent courts and competent public authorities, and the application of the laws, of the Foreign State in which the Customer is domiciled, constituted or established.
2. The jurisdiction under paragraph (1) of the competent courts and competent public authorities shall mean the power to issue valid and binding orders to the Service Provider or the relevant Customer, in accordance with the laws of the relevant Foreign State, concerning the Customer Content, including orders for providing access, disclosure, preserving or maintaining the integrity of the Customer Content.
3. Where a Service Provider receives an order from a competent court or competent public authority of a Foreign State, based on its jurisdiction over the Customer Content under this section, the Service Provider shall as soon as practicable inform the Attorney General in writing of the order and provide him with a copy of such order.
4. The competent judge and the Attorney General in the Kingdom, each in his respective capacity according to the Information Technology Crimes Law, shall if requested by a competent court or a public authority of a Foreign State, order the enforcement of any executable order, which is final and not subject to further appeal, issued by such court or public authority pursuant to its powers under this section that relates to providing access, disclosure, preserving or maintaining the integrity of Customer Content, or any matter in connection with Customer Content in respect of which the competent judge or the Attorney General has power under the Information Technology Crimes Law.

Section 4
Designation of Foreign States and Data Centres

1. Data Centres and Foreign States referred to under this law shall be designated under a Regulation to be issued by the Council of Ministers and published in the official gazette. If a Service Provider has more than one Data Centre in the Kingdom, the designation shall apply to all Data Centres of that Service Provider.
2. The Council of Minsters may issue a regulation to be published in the official gazette excluding a specific Foreign State or a Data Centre from those that were previously designated under paragraph (1), provided that in this event the provisions of this law shall continue to be applicable in respect of such Foreign State or Data Centre, as the case may be, for one hundred and twenty (120) calendar days following the effective date of the said regulation. If a Service Provider has more than one Data Centre in the Kingdom, the exclusion shall apply to all Data Centres of that Service Provider.

Section 5
International Agreements, Treaties and Conventions

This law does not derogate from any additional protection or privileges provided under other laws, international agreements or conventions in force in the Kingdom of Bahrain.

Section 6
Coming into Effect

The Prime Minister and the Ministers – each in his respective capacity- shall implement the provisions of this law, which shall come into effect on the day following its publication in the Official Gazette.