Bahrain Outbound Calling Compliance: TRA (2026)

Quick answer

Outbound contact in Bahrain is regulated by the Telecommunications Regulatory Authority (TRA) under the Telecommunications Law of 2002 and the Bulk Messaging Regulation of 2015, while the data behind your lists falls under the Personal Data Protection Law, Law No. (30) of 2018. Bulk messaging runs on express opt-in with a free per-operator opt-out, and Bahrain has no national Do Not Call register. The published window of 09:00 to 20:00 Bahrain time covers solicited bulk messages sent to 100 or more recipients, and no permitted-hours rule for voice telemarketing has been published.

Bahrain has a binding instrument for bulk messaging and a full data protection law, but it has published far less about voice telemarketing than its neighbours. This guide sets out what the regulator has published as at September 2026, separates it from what it has not, and maps each rule to a control.

At a Glance

Item	Position in Bahrain
Regulator	Telecommunications Regulatory Authority (TRA), هيئة تنظيم الاتصالات
Law and date	Bulk Messaging Regulation, TRA Board Resolution No. (3) of 2015, signed 17 June 2015, under the Telecommunications Law of 23 October 2002
Licence needed	None specific to telemarketing or call centres. Messaging and VAS providers hold a Value Added Services class licence, granted for fifteen years
Calling hours	09:00 to 20:00 "according to the Kingdom of Bahrain's timing" for solicited bulk messages to 100 or more recipients. No voice hours rule is published, and the UTC offset behind that wording is not published
Consent model	Express opt-in for bulk messages. Under the PDPL, explicit consent in writing including electronic form, before processing
Do Not Call list	No national register. A free per-operator opt-out is mandatory, and consumers block a sender by texting "block" and the sender ID to 88444
Caller ID rule	No CLI presentation or spoofing regulation is published. The duty is in-message: every solicited bulk message carries the source's identity and a valid telephone number or email address
Recording rule	No TRA notice-or-consent rule for business call recording. A recording is personal data, and tapping or disclosing a conversation without Public Prosecution or court authorisation is an offence
Data protection law	Personal Data Protection Law, Law No. (30) of 2018, Gazette Issue 3375, 19 July 2018, in force 1 August 2019
Penalties	PDPL administrative fine up to BHD 20,000 plus a daily coercive fine up to BHD 1,000, or BHD 2,000 on repeat within three years. PDPL criminal offences carry BHD 1,000 to BHD 20,000 and up to one year
Consent validity period	Not published
Retention period for recordings	Not published

Who Regulates Outbound Calling in Bahrain

The TRA regulates telecommunications under Legislative Decree No. 48 of 2002. Article 3(b) charges it with protecting subscribers' personal particulars and the privacy of services, and Article 24(a) makes it unlawful to provide a telecommunications service without a licence or exemption.

Data protection sits elsewhere. Law No. (30) of 2018 created a Personal Data Protection Authority, but Decree No. (78) of 2019 assigned its duties to the Ministry of Justice, Islamic Affairs and Waqf until that Authority is funded and its board formed. The PDPA site still presents that decree as the governing arrangement.

One point matters most for planning. The complete TRA instrument inventory was enumerated in September 2026, covering 65 Regulations, 94 Determinations and Decisions, 55 Orders and the Position Papers and Guidelines listing, and none establishes a telemarketing or outbound-dialling licence for a non-telecom business. The obligations reach you through your operator contract and the data protection law.

Consent and Opt-Out

For bulk messaging the model is express opt-in. Article 4(a) allows bulk messages only to recipients who have expressly consented. Article 4(b) puts record-keeping on the marketer: consent is acquired by the Source, which must maintain correct and updated records, and the operator must procure the right to obtain copies of those records and consent forms.

The data protection layer is stricter about form. Order No. (48) of 2022 requires explicit consent in writing, including by electronic means, before processing data collected directly from the person, and invalidates consent obtained through a cookie wall. Withdrawal must be easy, free and available at any time once identity is proven.

Two PDPL articles govern marketing directly. Article 19 requires a controller that anticipates using data for direct marketing to tell the person, free of charge, that they may object. Article 20 gives them that right: on a request with proof of identity, the controller must stop and answer within a period not exceeding ten working days. No instrument sets a maximum validity for marketing consent, so set your own expiry as policy.

Do-Not-Call

Bahrain has no national Do Not Call register. The chosen mechanism is a per-operator opt-out. Article 3(a) requires operators to give a free option to opt out of any bulk message from any source identified by numbers or alphanumeric codes, whether solicited or not. Article 3(b) requires that option to be a free SMS or a toll-free number, and Article 3(c) requires the procedure to be published on the operator's website, in its call centres and on flyers at its outlets.

Consumers also have a blocking shortcode: the TRA consumer FAQ states they may block nuisance messages by sending "block" and the sender's ID to 88444. That is recipient-initiated blocking at the operator, not a list a marketer can query, so no checking duty arises. Complaints escalate to the TRA Consumer Centre on 81188. Your own suppression file is the compliance artefact.

Calling Hours and Days

Article 4(c) allows solicited bulk messages only between 09:00 and 20:00 according to the Kingdom of Bahrain's timing. Article 4(d) adds a cap of one solicited bulk message per day to any single recipient on behalf of any single source, unless expressly agreed otherwise. A Bulk Message is an SMS or MMS sent, or intended to be sent, to one hundred or more recipients in Bahrain at one time to offer, advertise or promote goods, services, events or business opportunities. Public security announcements, network fault notices and announcements required by law are excluded.

There is no weekend or public-holiday restriction in the Regulation; Articles 1 to 8 contain only the window and the daily cap. For voice, no permitted-hours rule could be confirmed. The only provision touching marketing voice calls is Article 15(1) of the Consumer Protection (Telecommunications Services) Regulation of 2017, which requires advertisers using direct contact advertisement to keep the number of calls, emails or SMS "non-intrusive". No hours are stated. Treat the messaging window as the regulator's expressed view of acceptable contact hours, configure voice conservatively, and confirm before launch. No government page states the UTC offset behind "the Kingdom of Bahrain's timing".

Caller ID and Number Presentation

No CLI presentation rule, anonymous-call rule or anti-spoofing rule for marketers was found in Bahraini telecoms law. The Telecommunications Law, the 65 Regulations, the 94 Determinations and Decisions, the 55 Orders, the National Numbering Plan of 4 February 2016 and the TRA Data Protection Guidelines of 13 February 2024 were all searched. There is also no alphanumeric sender-ID registration regime.

The identification duty that does exist is in the message. Article 4(e) requires each solicited bulk message to specify the identity and contact details of the source it is sent on behalf of, including at minimum a valid telephone number or email address. Article 4(f) requires the opt-out procedure to be stated, and Article 4(g) the cost of replying where it exceeds a standard message.

Spoofing is handled as fraud, through the operators. The TRA Guidelines on Reducing Fraudulent SMS of 27 August 2025 name SMS originator spoofing as identity theft and require mobile network operators to maintain blacklists of fraudulent numbers. Separately, Article 75(1) of the Telecommunications Law makes it an offence, with a fine up to BHD 10,000, to send a message knowing its contents are false or misleading.

Call Recording and Notices

There is no TRA rule requiring a recording notice or the caller's consent for ordinary business call recording. The Telecommunications Law, the Consumer Protection Regulation, the Consumer Dispute Regulation, the Bulk Messaging Regulation and the TRA Data Protection Guidelines were all searched for one.

What exists is a criminal provision and a data-protection duty. Article 75(2) sets a fine up to BHD 10,000 for tapping into or disclosing the secrecy of any conversation or message data unless permitted by the Public Prosecutor's Office or by court order. Section 13.2 of the TRA Data Protection Guidelines tells controllers not to use network apparatus capable of recording, listening, tapping or silently monitoring communications unless this complies with the laws of the Kingdom. A recording is personal data, so PDPL Article 4 governs the basis, and Article 17(1) requires you to tell the person your identity and address, the purposes, the recipients, whether answering is mandatory, and whether the data will be used for direct marketing.

Messaging Rules for SMS and WhatsApp

The Bulk Messaging Regulation binds licensed operators, not marketers directly. Article 2 applies it to all licensed operators sending bulk messages, and Article 4 reaches marketers through the operator, which shall comply or shall procure that the Contracted Source complies. Your route to compliance runs through the operator contract, and a breach becomes a material breach of the operator's licence.

A compliant Bahraini SMS campaign therefore carries express prior consent recorded by you, at most one message per recipient per day per source, a send time inside 09:00 to 20:00, the source's identity and a valid phone number or email in the body, a stated opt-out procedure, and a stated reply cost where replying costs more than a standard message. Nothing in the published instruments addresses WhatsApp by name; the definitions are written around SMS and MMS. The PDPL duties apply to any channel, so treat those as the floor and confirm channel-specific expectations with the TRA.

Data Protection and Retention

PDPL Article 4 prohibits processing without consent unless it is necessary for a contract with the person, pre-contractual steps at their request, a legal obligation or court order, their vital interests, or the legitimate interests of the controller where that does not conflict with their fundamental rights. The PDPA's own summary states the rule more strictly, as written and explicit consent, so relying on legitimate interests for cold marketing is not a comfortable position.

Two administrative duties catch outbound operations. Article 14(1) requires notification to the Authority before starting automated processing, with exemptions including the case where a Data Protection Guardian has been appointed. Article 15 requires prior written authorisation for certain processing, including automatic processing that links personal data across more than one entity.

Cross-border transfer runs on an adequacy list. Order No. (42) of 2022 permits direct transfer to the 83 countries and territories in its schedule without prior authorisation; anything else needs case-by-case authorisation. Retention has no fixed number for marketing data: Article 3(5) requires only that data not remain identifiable once the purpose is exhausted. Fixed periods exist in the telecom sector alone, where traffic data is erased or anonymised after one year and billing and complaint records are kept for at least twelve months.

Penalties and Enforcement

Cite the right statute, because the regimes are separate. Under the PDPL, Article 55 lets the Board order a violator to stop a breach and, on non-compliance, withdraw an Article 15 authorisation, impose a daily coercive fine up to BHD 1,000 for a first breach and BHD 2,000 for a further breach within three years, and impose an administrative fine up to BHD 20,000. Article 58(1) sets imprisonment up to one year and a fine of BHD 1,000 to BHD 20,000 for listed offences including unlawful cross-border transfer and processing without notifying the Authority, and Article 59 doubles the fine for a legal person. Direct-marketing breaches are not criminal: Articles 19 and 20 are absent from the Article 58(1) list, so they run through the complaint route and the Article 55 measures.

Under the Telecommunications Law, Article 73(e) punishes providing a service without a licence with up to six months and a fine up to BHD 500,000. Article 75 sets a fine up to BHD 10,000 for a knowingly false or misleading message or unlawful tapping. Article 35 lets the TRA, after written notice with at least thirty days to respond, order a licensee to act, impose a fine, and ultimately revoke the licence.

What Changed in 2025 and 2026

Less than you might expect. The significant new instrument is the TRA Guidelines on Reducing Fraudulent SMS, issued 27 August 2025 and published 30 September 2025. They require mobile network operators to maintain blacklists of fraudulent numbers, provide a user reporting mechanism, meet a minimum detection accuracy target of 99% with a false-positive rate below 1%, and report annually by 31 January. These bind operators rather than marketers, but a legitimate campaign that looks like grey-route traffic is now more likely to be filtered.

The TRA Data Protection Guidelines for the telecommunications sector, published 13 February 2024, took effect six months later. A Distance Selling Guidelines consultation ran from 14 November 2023 to 21 December 2023 and no final guidelines have appeared. No new spam, bulk-messaging, Do Not Call, CLI or telemarketing regulation was made in 2025 or 2026.

One financial-sector point, per the Central Bank of Bahrain Rulebook Volume 1, Module BC-1.2.1 as amended in January 2022 (secondary source): conventional retail bank licensees must allow customers a means to opt out of promotional material by email, SMS, WhatsApp or other communication means.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. It does not make an operator compliant, and the legal responsibility stays with the operator.

Bahraini rule	Control that supports it
Express opt-in, records held by the source	Consent recorded, updated and revoked as a record you can produce on request
Stop direct marketing within ten working days	A revocation takes effect on the next attempt, not the next list refresh
Per-operator opt-out, no national register	Your own do-not-call list is imported once, then searched on every attempt
09:00 to 20:00 messaging window	Bahrain TRA ships as a jurisdiction pack, applying the window per campaign
One message per recipient per day	Repeat attempts limited automatically by the frequency rule
Identify the source inside the message	SMS sent under your own sender IDs from a reviewed template library
Present a number you are answerable for	A caller ID belongs to one tenant exclusively, with per-tenant pools and daily caps
Recording is personal data, no fixed retention	Configurable retention, signed-URL playback, legal hold and auditor export
Explain an exception later	Each override of a rule is recorded with an audit trail
Reach contacts in a language they understand	Language-aware AI across 11 languages, with UCS-2 aware SMS segment counting

Bahrain Outbound Compliance Checklist

Buy bulk messaging through a licensed Bahraini operator and sign as a Contracted Source.
Capture express prior consent for every bulk-message recipient and store the consent form.
Give the operator the contractual right to copy your consent records.
Hold PDPL consent in writing or electronic form, before processing begins.
Send solicited bulk messages only between 09:00 and 20:00 Bahrain time.
Cap solicited bulk messages at one per recipient per day per source.
Put the source's identity and a valid telephone number or email address in every message.
State the opt-out procedure, and the reply cost where it exceeds a standard message.
Stop direct marketing and answer within ten working days of a valid objection.
Suppress opt-outs permanently across every campaign and tenant.
Set your own consent expiry policy, because no instrument sets one.
Notify the Authority before starting automated processing, or appoint a Data Protection Guardian.
Check the Order 42/2022 adequacy list before moving Bahraini personal data offshore.
Configure conservative voice calling windows and confirm them with the TRA.

Sources

Telecommunications Law, Legislative Decree No. 48 of 2002, TRA translation current as at 10 October 2023. TRA Regulations listing
Bulk Messaging Regulation, TRA Board Resolution No. (3) of 2015, signed 17 June 2015.
Consumer Protection (Telecommunications Services) Regulation, 4 December 2017.
TRA Guidelines on Privacy and Data Protection in the Telecommunications Sector, 13 February 2024.
TRA Guidelines on Reducing Fraudulent SMS, 27 August 2025, published 30 September 2025.
TRA National Numbering Plan, 4 February 2016.
TRA consumer information, shortcode 88444 and Consumer Centre 81188. TRA consumer page
Personal Data Protection Law No. (30) of 2018, Gazette Issue 3375, 19 July 2018. PDPA overview
Decree No. (78) of 2019, 29 September 2019. PDPA royal decree page
Orders No. (42) and No. (48) of 2022, both 17 March 2022. PDPA executive decisions
Secondary source: Central Bank of Bahrain Rulebook Volume 1, Module BC-1.2.1, amended January 2022.

Frequently Asked Questions

Do I need a licence to run outbound telemarketing in Bahrain?

Not a telemarketing licence. The complete TRA instrument inventory was enumerated in September 2026, covering 65 Regulations, 94 Determinations and Decisions and 55 Orders, and none establishes a telemarketing or call-centre regime for non-telecom businesses. Messaging and value-added-service providers use the Value Added Services class licence, granted for fifteen years.

What are the legal calling hours in Bahrain?

Article 4(c) of the Bulk Messaging Regulation allows solicited bulk messages only between 09:00 and 20:00 according to the Kingdom of Bahrain's timing, for messages sent to 100 or more recipients at one time for promotional purposes. No permitted-hours rule for voice telemarketing has been published, so configure voice conservatively and confirm with the TRA.

Does Bahrain have a national Do Not Call register?

No. The Regulation's mechanism is a free per-operator opt-out under Article 3, and Article 3(d) reserves to the TRA only the power to set procedures for a harmonised opt-out. Consumers can block a sender by texting "block" and the sender ID to 88444. Your own suppression file plus the ten-working-day stop under PDPL Article 20 is the operative duty.

Is consent required for marketing messages in Bahrain?

Yes for bulk messages. Article 4(a) allows sending only to recipients who have expressly consented, and Article 4(b) requires the source to keep correct and updated consent records the operator can copy. Under the PDPL, explicit consent in writing including electronic form must be obtained before processing data collected directly from the person.

How quickly must I honour an opt-out in Bahrain?

PDPL Article 20 requires the controller, on a request supported by proof of identity, to stop processing for direct marketing and to notify the person free of charge within a period not exceeding ten working days whether it has complied, complied partially, or refused, with reasons. Failure to respond entitles the person to complain to the Authority.

Do I have to announce that a call is being recorded in Bahrain?

No TRA rule requires a recording notice or the caller's consent for ordinary business call recording. A recording is still personal data, so PDPL Article 4 governs the basis and Article 17(1) requires you to tell the person your identity, the purposes, the recipients and whether the data will be used for direct marketing. Unlawful tapping carries a fine up to BHD 10,000.

What are the penalties for a marketing breach in Bahrain?

Direct-marketing breaches are not criminal under the PDPL, since Articles 19 and 20 are absent from the Article 58(1) list. They run through the complaint route and the Article 55 administrative measures, which allow a daily coercive fine up to BHD 1,000, or BHD 2,000 for a repeat within three years, and an administrative fine up to BHD 20,000.

Can I send WhatsApp marketing to Bahraini numbers?

The published instruments do not address WhatsApp by name; the Bulk Messaging Regulation is written around SMS and MMS. The PDPL duties on explicit consent, notice, the right to object and the ten-working-day stop apply whatever the channel, so treat those as the floor and confirm with the TRA before you scale.