Processes personal data, in Kuwait

Law No. 9 of 2019 Regulating the Exchange of Credit Information, arts. 3 to 7, 10 and 13 to 16 · Read the law's page

• A credit information company must be a Kuwaiti public shareholding company licensed by the Central Bank of Kuwait and registered with it before it operates, and no other company may engage in the exchange of credit information (Article 3).
• Obtain the customer's authorization before an inquiry into the customer's information is made (Article 4), and do not gather or exchange information on a natural person's private life, opinions, beliefs or health condition (Article 6).
• Keep credit information, credit records and credit reports confidential, and do not reveal them without the customer's consent or a request of the competent judicial authorities (Article 7).
• Protect and secure the information against loss, damage and unlicensed or unsecure access, use or alteration (Article 10, item 4), and reply in writing to a customer's complaint, with grounds, within 15 days (Article 13).

Data Classification Policy, version 2.3 (Communication and Information Technology Regulatory Authority, listed 16 June 2022) · Read the law's page

• Classify all digital data you process, store, modify, or transfer into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, Highly Sensitive Data) and label it accordingly.
• Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.
• Maintain a unified data catalog with metadata describing your classified data, and review the classification periodically.
• Transfer or remove Tier 3 and Tier 4 data from a data center's or server's storage before decommissioning that equipment.
• Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.
• This binds a data owner in Kuwait, meaning an individual, government entity, or private company that owns data and has authority to process, amend, copy, or store it; entities of a security or military nature are excluded from this four-tier classification scheme and may classify their own data as they see fit.

CITRA Decision No. 26 of 2024 (repealing Decision No. 42 of 2021) · Read the law's page

• An app that is a CITRA-licensed telecommunications or information-technology service provider in Kuwait must, before providing the service, give the user the information the regulation lists, obtain the user's consent and state the purpose of the collection (Article 2); may collect and process personal data only on a ground Article 3 lists, including consent, with a legal guardian's written consent for a user under 18; and must apply the security measures Article 5 lists, including encryption. Kuwait has no general cross-sector personal-data statute, and an app that is not a CITRA licensee is not a service provider under this regulation.
• While providing the service and after it ends, give users clear information on how personal data is collected, processed and kept, state the purpose, the legal basis and the retention period, identify the provider and say how to contact it, process the data so as to protect it against unauthorized or unlawful processing, loss and damage, obtain the user's consent before disclosing personal data to a third party for marketing, publish a written privacy policy on the provider's website, and build privacy into the design of services (Article 4).

CITRA Decision No. 26 of 2024, regulation Article 4(15), Article 5(12) and Article 6 (breach notification) · Read the law's page

• Notify CITRA of a personal data breach within 24 hours after becoming aware of it, through CITRA's official channels of communication, stating the nature and extent of the breach, the persons and security levels affected, the data protection officer's name and contact, and the likely consequences and the measures taken or proposed (Article 6).
• Notify the data subject of a breach of their personal data, unless you applied appropriate technical and organizational protection measures to the data affected, and take later measures that keep the risks to data subjects' rights and freedoms from rising (Article 6).
• Where an incorrect disclosure of stored user data, or access to it, seriously harms a large number of users, notify CITRA, the users and law enforcement as soon as possible and in any case within 72 hours (Article 4).

CITRA Decision No. 26 of 2024, regulation Article 4(5), Article 5(4)-(5) and Article 7 (records, reporting to CITRA and compliance) · Read the law's page

• Notify CITRA when you disclose users' personal data, directly or indirectly, to a company affiliated with or owning you or to a third party, and remain responsible for the privacy protection of the data shared (Article 4).
• Keep records of processing activities that name you, your representative and your data protection officer, the purposes of processing, the categories of data subjects and data, any transfer abroad and a general description of your security measures, and make them available to CITRA on request (Article 5).
• Bring your operations into line with the regulation within one year of its publication, and follow CITRA's instructions and guidance on data privacy (Article 7).

CITRA Decision No. 26 of 2024, regulation Article 4(6), (8), (10), (12), (13) and Article 5(9) (user rights) · Read the law's page

• Give users appropriate technological means to exercise their right to access, review and correct their personal data, and a mechanism to obtain, correct, remove, restrict access to or object to the processing of their personal data, or request its transfer (Article 4).
• Give users an easy, practical way to modify their data, withdraw consent, disable a service or change how their data is collected, used, processed or disclosed, and delete a user's personal data when consent is withdrawn, the data is no longer needed for the services requested, the user is no longer subscribed, or the contract ends (Article 4).
• Run internal systems that receive and study complaints and requests for access to, correction of or deletion of data around the clock (Article 5).

CITRA Decision No. 26 of 2024, regulation Article 4(7) and (9) (storage location and transfer outside Kuwait) · Read the law's page

• Tell users where their personal data is stored, whether inside or outside Kuwait, and inform the data subject where you will transfer their personal data outside Kuwait (Article 4).
• Record in your processing records any transfer of personal data abroad, with the country identified (Article 5).

Electronic Transactions Law No. 20 of 2014, arts. 32 and 35 · Read the law's page

• Do not unlawfully access, disclose or publish personal data registered in your electronic processing records or systems about a person's positional affairs, personal status, health status or financial disclosure, unless the person or a legal representative approved or a reasoned judicial statement allows it (Article 32).
• State the purpose of collecting the personal data and collect it only within the limits of that purpose (Article 32).
• Do not collect, register or process the personal data by illegal methods or without the consent of the person concerned or a representative, and do not use it for a purpose other than the one it was collected for (Article 35).
• Verify the accuracy of the personal data, complete and update it regularly, and take appropriate measures to protect it against loss, damage, disclosure, replacement with incorrect data and the addition of untrue information (Article 35).

Electronic Transactions Law No. 20 of 2014, arts. 33 and 36 · Read the law's page

• Respond to a person's request, or a legal representative's request, for access to the personal data you hold about that person, and give a formal extract of it on request, except for data government security bodies keep for reasons of national security (Article 33).
• Delete or amend a person's personal data when the person asks and the data is invalid or does not conform with reality, and replace the information to reflect later amendments (Article 36).

Electronic Transactions Law No. 20 of 2014, arts. 37, 39 and 40 · Read the law's page

• Do not violate Article 32 or Article 35 items (a) and (b), which carry criminal penalties; a company is jointly responsible for the financial penalties and compensation when an employee acting for it commits the violation (Articles 37 and 39).

Law No. 37 of 2014 Establishing the Communications and Information Technology Regulatory Authority, as amended by Law No. 98 of 2015, art. 64 · Read the law's page

• Remove a violation within 30 days of CITRA's warning, and comply with the measures CITRA orders for a violation of the Law or of the regulations or decisions issued under it, which include suspension of the licence for three months, a fine of up to one million Kuwaiti dinars for each violation and cancellation of the licence (Article 64).