Your ID, Your Privacy – Delivery Drivers Can’t Photograph It in Bahrain

The Personal Data Protection Authority (PDPA) has issued a new directive prohibiting delivery drivers and courier companies from taking photos of customers’ ID cards using mobile phones. The decision aims to safeguard customers’ privacy and ensure their personal data remains secure.

In its Circular No. (1) of 2025, the authority stated that the regulation aligns with Bahrain’s Personal Data Protection Law (Law No. 30 of 2018) and reinforces the principles of confidentiality and data security across service sectors.

According to the circular, delivery and courier companies must refrain from photographing ID cards via personal phones when verifying the recipient’s identity. Instead, couriers are required only to view the ID for confirmation purposes — without saving or storing any image or copy on their devices.

If a company’s operational procedures require retaining a copy of the ID, the circular mandates strict conditions:

• The courier’s device must be directly linked to the company’s secure central database, ensuring the image is uploaded instantly without being stored locally.

• Alternatively, companies may use dedicated corporate devices designed for safe, direct data transfer into internal systems.

The PDPA emphasized that data managers and supervisors within delivery and logistics companies are legally obligated to implement these measures and could face penalties for noncompliance. The authority also urged companies to foster a stronger culture of data protection among their staff, applying best practices throughout all stages of service and administration.

Concluding its statement, the PDPA reaffirmed that this directive forms part of a broader national effort to enhance public awareness about privacy rights and ensure that personal data handling in Bahrain meets the highest global standards of safety and integrity.