Framework overlap

Does NIS2 Directive cover Bahrain PDPL?

You hold NIS2 Directive and have been told to do Bahrain PDPL. Here is how much overlaps, control by control.

45% of Bahrain PDPL you already have

NIS2 Directive already covers about 45% of Bahrain PDPL, leaving 16 of 29 controls as genuinely new work.

Already covered 4 Likely covered 9 New work 16

What is genuinely new work

Nothing in NIS2 Directive reaches these. This is the list to scope.

BH-PDPL-01
Notice and transparency requirements
BH-PDPL-03
Lawful basis for processing
BH-PDPL-04
Purpose limitation and specification
BH-PDPL-06
Right of access to personal data
BH-PDPL-07
Right to rectification of inaccurate data
BH-PDPL-08
Right to erasure and deletion
BH-PDPL-10
Right to restrict processing
BH-PDPL-11
Right to object to processing
BH-PDPL-12
Automated decision-making protections
BH-PDPL-14
Pseudonymization techniques
BH-PDPL-20
Records of processing activities
BH-PDPL-23
Data processing agreements
BH-PDPL-26
Training and awareness programs
BH-PDPL-27
Regulatory reporting and cooperation
BH-PDPL-28
Complaints handling and resolution
BH-PDPL-29
Enforcement and penalties awareness
Show the 13 you already have
BH-PDPL-15
Access control for personal data
BH-PDPL-16
Data breach notification requirements
BH-PDPL-17
Security incident response procedures
BH-PDPL-21
Data protection impact assessments
BH-PDPL-02
Consent management and withdrawal
BH-PDPL-05
Data minimization requirements
BH-PDPL-09
Right to data portability
BH-PDPL-13
Encryption of personal data
BH-PDPL-18
Regular security testing and assessment
BH-PDPL-19
Data protection officer designation
BH-PDPL-22
Privacy by design and default
BH-PDPL-24
Cross-border transfer safeguards
BH-PDPL-25
Compliance monitoring and auditing

How this is calculated

Already covered means a mapping runs from a control in NIS2 Directive to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition