KuwaitCITRA Data Privacy Protection Regulation, records, reporting to CITRA and compliance period
In force.
An enforcement supervision rule binding private bodies.
- Obligation class
- Governance, Reporting
As of .
What it requires
- Notify CITRA when you disclose users' personal data, directly or indirectly, to a company affiliated with or owning you or to a third party, and remain responsible for the privacy protection of the data shared (Article 4).
- Keep records of processing activities that name you, your representative and your data protection officer, the purposes of processing, the categories of data subjects and data, any transfer abroad and a general description of your security measures, and make them available to CITRA on request (Article 5).
- Bring your operations into line with the regulation within one year of its publication, and follow CITRA's instructions and guidance on data privacy (Article 7).
These lines are LexLint's reading of the law's text, as of .
What this law does
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 4(5) requires a service provider to notify CITRA where it discloses users' personal data directly or indirectly to a company affiliated with or owning the provider, or to a third party, and keeps the provider responsible for the privacy protection of the data shared.
Article 5(4) requires records of processing activities, naming the provider and its representative and data protection officer, the purposes of processing, the categories of data subjects and data, any transfer abroad, and a general description of the security measures, and Article 5(5) requires the provider to make the records available to CITRA on request.
Article 7(1) requires every provider and every holder of an authorization to own public communications networks to bring itself into line with the regulation within one year of its publication. Article 7(2) lets CITRA issue instructions or guidance on data privacy whenever necessary.
Article 7(3) provides that, where a violation of the regulation or of Kuwait's laws is established, CITRA may apply the penalties and fines provided in Law No. 37 of 2014 establishing the Communications and Information Technology Regulatory Authority, as amended by Law No. 98 of 2015.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data, processes voice recordings or provides telecom services.