KuwaitCITRA Data Privacy Protection Regulation, personal data breach notification
In force.
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Notify CITRA of a personal data breach within 24 hours after becoming aware of it, through CITRA's official channels of communication, stating the nature and extent of the breach, the persons and security levels affected, the data protection officer's name and contact, and the likely consequences and the measures taken or proposed (Article 6).
- Notify the data subject of a breach of their personal data, unless you applied appropriate technical and organizational protection measures to the data affected, and take later measures that keep the risks to data subjects' rights and freedoms from rising (Article 6).
- Where an incorrect disclosure of stored user data, or access to it, seriously harms a large number of users, notify CITRA, the users and law enforcement as soon as possible and in any case within 72 hours (Article 4).
These lines are LexLint's reading of the law's text, as of .
What this law does
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 6(1) requires a service provider to send CITRA a notice of a personal data breach within 24 hours after becoming aware of it, through the official channels of communication.
Article 6(2) requires the notice to include the nature of the breach and its extent, the persons and security levels affected, the name and contact mechanism of the data protection officer, and the likely consequences of the breach and the measures taken or proposed to deal with it.
Article 6(3) requires the provider to notify the data subject of breaches of the data subject's personal data, and Article 6(4) removes that duty where the provider took appropriate technical and organizational protection measures and applied them to the data affected by the breach. Article 6(5) requires later measures that ensure the risks to the rights and freedoms of data subjects do not rise.
Article 4(15) separately requires a provider whose incorrect disclosure of stored personal data, or access to it, seriously harms a large number of users to notify CITRA, the users and law enforcement as soon as possible and in any case within 72 hours.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data, processes voice recordings or provides telecom services.