KuwaitCITRA Data Privacy Protection Regulation
CITRA Decision No. 26 of 2024 (repealing Decision No. 42 of 2021)
In force.
A comprehensive regime rule binding private bodies.
What it requires
- An app that is a CITRA-licensed telecommunications or information-technology service provider in Kuwait must, before providing the service, give the user the information the regulation lists, obtain the user's consent and state the purpose of the collection (Article 2); may collect and process personal data only on a ground Article 3 lists, including consent, with a legal guardian's written consent for a user under 18; and must apply the security measures Article 5 lists, including encryption. Kuwait has no general cross-sector personal-data statute, and an app that is not a CITRA licensee is not a service provider under this regulation.
- While providing the service and after it ends, give users clear information on how personal data is collected, processed and kept, state the purpose, the legal basis and the retention period, identify the provider and say how to contact it, process the data so as to protect it against unauthorized or unlawful processing, loss and damage, obtain the user's consent before disclosing personal data to a third party for marketing, publish a written privacy policy on the provider's website, and build privacy into the design of services (Article 4).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does the Data Privacy Protection Regulation take effect under Article 3 of Decision 26 of 2024 on the date of its publication in the Official Gazette or on the date of its publication on the website of the Communications and Information Technology Regulatory Authority, where Article 3 provides for publication in both places and applies the regulation from the date of its publication?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
The closing paragraph of Article 3 says that in all cases the service provider must be able to prove the data subject's consent to the processing. A provider cannot show that without keeping a record of the consent. The article names no format, period or recipient for that record. The records of processing that the service provider keeps under Article 5(4) are a separate duty.
- Kind
- Implicit
- As of
- Provision
- Article 3, closing paragraph (the service provider must be able to prove the data subject's consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Kuwait has no cross-sector data-protection statute. CITRA issued Decision 26 of 2024 on . The Decision puts into effect the Data Privacy Protection Regulation that the board adopted at its meeting 14/2023 of (Article 1 of the Decision). Article 2 of the Decision repeals the regulation in force under Decision 42 of 2021 and its amendments.
Under Article 3 of the Decision, the regulation takes effect from the date of its publication in the Official Gazette and on CITRA's website. The Decision was published in the Official Gazette on . Service providers have one year from publication to reconcile their situations with its provisions.
The regulation defines the service provider, also called the licensee, as the person licensed to provide a service, and its duties fall on that licensed provider, so it applies to CITRA-licensed telecommunications and information-technology service providers and is not a general national data-protection law.
The regulation sets conditions for collecting and processing personal data (Article 2), for the lawfulness of collection and processing (Article 3), for data security (Article 5) and for notification of breaches (Article 6).
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .