KuwaitCITRA Data Privacy Protection Regulation, storage location and transfers outside Kuwait
In force.
A cross border transfer rule binding private bodies.
- Obligation class
- Transfer, Disclosure
As of .
What it requires
- Tell users where their personal data is stored, whether inside or outside Kuwait, and inform the data subject where you will transfer their personal data outside Kuwait (Article 4).
- Record in your processing records any transfer of personal data abroad, with the country identified (Article 5).
These lines are LexLint's reading of the law's text, as of .
What this law does
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 4(7) requires a service provider to give information on where personal data is stored, whether inside or outside Kuwait. Article 4(9) requires it to inform the data subject where the provider will transfer the data subject's personal data outside Kuwait.
Article 5(4) requires the provider's processing records to describe any transfer of personal data abroad, with the country identified. The regulation does not bar transfers outside Kuwait or require data to stay in Kuwait.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data, processes voice recordings or provides telecom services.