Provides telecom services, in Kuwait

CITRA Decision No. 26 of 2024 (repealing Decision No. 42 of 2021) · Read the law's page

• An app that is a CITRA-licensed telecommunications or information-technology service provider in Kuwait must, before providing the service, give the user the information the regulation lists, obtain the user's consent and state the purpose of the collection (Article 2); may collect and process personal data only on a ground Article 3 lists, including consent, with a legal guardian's written consent for a user under 18; and must apply the security measures Article 5 lists, including encryption. Kuwait has no general cross-sector personal-data statute, and an app that is not a CITRA licensee is not a service provider under this regulation.
• While providing the service and after it ends, give users clear information on how personal data is collected, processed and kept, state the purpose, the legal basis and the retention period, identify the provider and say how to contact it, process the data so as to protect it against unauthorized or unlawful processing, loss and damage, obtain the user's consent before disclosing personal data to a third party for marketing, publish a written privacy policy on the provider's website, and build privacy into the design of services (Article 4).

CITRA Decision No. 26 of 2024, regulation Article 4(15), Article 5(12) and Article 6 (breach notification) · Read the law's page

• Notify CITRA of a personal data breach within 24 hours after becoming aware of it, through CITRA's official channels of communication, stating the nature and extent of the breach, the persons and security levels affected, the data protection officer's name and contact, and the likely consequences and the measures taken or proposed (Article 6).
• Notify the data subject of a breach of their personal data, unless you applied appropriate technical and organizational protection measures to the data affected, and take later measures that keep the risks to data subjects' rights and freedoms from rising (Article 6).
• Where an incorrect disclosure of stored user data, or access to it, seriously harms a large number of users, notify CITRA, the users and law enforcement as soon as possible and in any case within 72 hours (Article 4).

CITRA Decision No. 26 of 2024, regulation Article 4(5), Article 5(4)-(5) and Article 7 (records, reporting to CITRA and compliance) · Read the law's page

• Notify CITRA when you disclose users' personal data, directly or indirectly, to a company affiliated with or owning you or to a third party, and remain responsible for the privacy protection of the data shared (Article 4).
• Keep records of processing activities that name you, your representative and your data protection officer, the purposes of processing, the categories of data subjects and data, any transfer abroad and a general description of your security measures, and make them available to CITRA on request (Article 5).
• Bring your operations into line with the regulation within one year of its publication, and follow CITRA's instructions and guidance on data privacy (Article 7).

CITRA Decision No. 26 of 2024, regulation Article 4(6), (8), (10), (12), (13) and Article 5(9) (user rights) · Read the law's page

• Give users appropriate technological means to exercise their right to access, review and correct their personal data, and a mechanism to obtain, correct, remove, restrict access to or object to the processing of their personal data, or request its transfer (Article 4).
• Give users an easy, practical way to modify their data, withdraw consent, disable a service or change how their data is collected, used, processed or disclosed, and delete a user's personal data when consent is withdrawn, the data is no longer needed for the services requested, the user is no longer subscribed, or the contract ends (Article 4).
• Run internal systems that receive and study complaints and requests for access to, correction of or deletion of data around the clock (Article 5).

CITRA Decision No. 26 of 2024, regulation Article 4(7) and (9) (storage location and transfer outside Kuwait) · Read the law's page

• Tell users where their personal data is stored, whether inside or outside Kuwait, and inform the data subject where you will transfer their personal data outside Kuwait (Article 4).
• Record in your processing records any transfer of personal data abroad, with the country identified (Article 5).

Law No. 37 of 2014 Establishing the Communications and Information Technology Regulatory Authority, as amended by Law No. 98 of 2015, art. 64 · Read the law's page

• Remove a violation within 30 days of CITRA's warning, and comply with the measures CITRA orders for a violation of the Law or of the regulations or decisions issued under it, which include suspension of the licence for three months, a fine of up to one million Kuwaiti dinars for each violation and cancellation of the licence (Article 64).