KuwaitCITRA Data Privacy Protection Regulation, user rights and consent controls
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights, Retention
As of .
What it requires
- Give users appropriate technological means to exercise their right to access, review and correct their personal data, and a mechanism to obtain, correct, remove, restrict access to or object to the processing of their personal data, or request its transfer (Article 4).
- Give users an easy, practical way to modify their data, withdraw consent, disable a service or change how their data is collected, used, processed or disclosed, and delete a user's personal data when consent is withdrawn, the data is no longer needed for the services requested, the user is no longer subscribed, or the contract ends (Article 4).
- Run internal systems that receive and study complaints and requests for access to, correction of or deletion of data around the clock (Article 5).
These lines are LexLint's reading of the law's text, as of .
What this law does
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 4(6) requires a service provider to use appropriate technological means that let users exercise their right of access to their personal data and to review and correct it. Article 4(8) requires it to set a mechanism for obtaining, correcting, removing, restricting access to, processing of, objecting to, or requesting transfer of personal data.
Article 4(10) requires it to delete the personal data in its possession when the contractual relationship with the data subject ends. Article 4(12) requires it to offer an easy, practical way for the user to modify data, withdraw consent, disable a service, or change the way data is collected, used, processed or disclosed.
Article 4(13) requires it to delete a user's personal data where the user withdrew consent for processing or use, the data are no longer needed to provide the services the user requested, or the user is no longer subscribed to the service the data was collected for. Article 5(9) requires internal systems to receive and study complaints, requests for access to data and requests to correct or delete it, around the clock.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data, processes voice recordings or provides telecom services.