Kuwait has no single, consolidated data protection statute. Obligations instead arise under sector-specific regimes and regulations issued by the competent supervisory authorities. The scope of a company's duties in respect of the personal data it holds is determined by the sector in which it is licensed and by the location of its customers. Foremost among them is the data protection regulation issued by CITRA. The firm identifies the regulatory framework applicable to each client, sets out the obligations it imposes in practice, and advises companies and financial institutions.
The Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority under Decision No. 26 of 2024 replaced the 2021 regulation and now binds entities licensed by CITRA in the telecommunications and internet sectors. It imposes consent, transparency, security and cross-border transfer requirements, and an obligation to notify a breach. Entities supervised by the Central Bank of Kuwait and the Capital Markets Authority carry their own separate requirements. Everyone else is governed by the general law, by the Electronic Transactions Law, Law No. 20 of 2014, and by whatever their contracts oblige them to do.
Where a client's operations or customer base extend into the European Union, the General Data Protection Regulation may apply on its own terms regardless of the Kuwaiti position, and the two have to be run together rather than in sequence. We advise on which of the client's activities are caught, and on the transfer mechanism that supports the movement of data out of Kuwait.
Our work covers processing and consent arrangements, privacy notices and policies, data sharing and cross-border transfer terms, controller and processor provisions, retention and deletion schedules, breach response and notification procedures, and the internal framework and records that allow a client to demonstrate compliance rather than assert it. We also advise on the data provisions in commercial contracts, and act where a breach has given rise to a regulatory or civil claim.