in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law5 instruments, 5 in force
Research summary (107 words)
Kuwait's data-protection posture is a regulation of the Communications and Information Technology Regulatory Authority (CITRA), not a comprehensive statute: the Data Privacy Protection Regulation issued under CITRA Decision 26 of 2024, dated , which repeals the regulation issued under Decision 42 of 2021 and its amendments.
The regulation defines the service provider, also called the licensee, as the person licensed to provide a service, and its duties fall on CITRA-licensed telecommunications and information-technology service providers, not on the private sector generally. A service provider must notify CITRA of a personal data breach within 24 hours after becoming aware of it (Article 6 of the regulation).
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 6(1) requires a service provider to send CITRA a notice of a personal data breach within 24 hours after becoming aware of it, through the official channels of communication.
Article 6(2) requires the notice to include the nature of the breach and its extent, the persons and security levels affected, the name and contact mechanism of the data protection officer, and the likely consequences of the breach and the measures taken or proposed to deal with it.
Article 6(3) requires the provider to notify the data subject of breaches of the data subject's personal data, and Article 6(4) removes that duty where the provider took appropriate technical and organizational protection measures and applied them to the data affected by the breach. Article 6(5) requires later measures that ensure the risks to the rights and freedoms of data subjects do not rise.
Article 4(15) separately requires a provider whose incorrect disclosure of stored personal data, or access to it, seriously harms a large number of users to notify CITRA, the users and law enforcement as soon as possible and in any case within 72 hours.
Kuwait has no cross-sector data-protection statute. CITRA issued Decision 26 of 2024 on . The Decision puts into effect the Data Privacy Protection Regulation that the board adopted at its meeting 14/2023 of (Article 1 of the Decision). Article 2 of the Decision repeals the regulation in force under Decision 42 of 2021 and its amendments.
Under Article 3 of the Decision, the regulation takes effect from the date of its publication in the Official Gazette and on CITRA's website. The Decision was published in the Official Gazette on . Service providers have one year from publication to reconcile their situations with its provisions.
The regulation defines the service provider, also called the licensee, as the person licensed to provide a service, and its duties fall on that licensed provider, so it applies to CITRA-licensed telecommunications and information-technology service providers and is not a general national data-protection law.
The regulation sets conditions for collecting and processing personal data (Article 2), for the lawfulness of collection and processing (Article 3), for data security (Article 5) and for notification of breaches (Article 6).
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 4(7) requires a service provider to give information on where personal data is stored, whether inside or outside Kuwait. Article 4(9) requires it to inform the data subject where the provider will transfer the data subject's personal data outside Kuwait.
Article 5(4) requires the provider's processing records to describe any transfer of personal data abroad, with the country identified. The regulation does not bar transfers outside Kuwait or require data to stay in Kuwait.
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 4(6) requires a service provider to use appropriate technological means that let users exercise their right of access to their personal data and to review and correct it. Article 4(8) requires it to set a mechanism for obtaining, correcting, removing, restricting access to, processing of, objecting to, or requesting transfer of personal data.
Article 4(10) requires it to delete the personal data in its possession when the contractual relationship with the data subject ends. Article 4(12) requires it to offer an easy, practical way for the user to modify data, withdraw consent, disable a service, or change the way data is collected, used, processed or disclosed.
Article 4(13) requires it to delete a user's personal data where the user withdrew consent for processing or use, the data are no longer needed to provide the services the user requested, or the user is no longer subscribed to the service the data was collected for. Article 5(9) requires internal systems to receive and study complaints, requests for access to data and requests to correct or delete it, around the clock.
The regulation binds a CITRA licensee, a person licensed to provide a service, and is not a general national data-protection law. Article 4(5) requires a service provider to notify CITRA where it discloses users' personal data directly or indirectly to a company affiliated with or owning the provider, or to a third party, and keeps the provider responsible for the privacy protection of the data shared.
Article 5(4) requires records of processing activities, naming the provider and its representative and data protection officer, the purposes of processing, the categories of data subjects and data, any transfer abroad, and a general description of the security measures, and Article 5(5) requires the provider to make the records available to CITRA on request.
Article 7(1) requires every provider and every holder of an authorization to own public communications networks to bring itself into line with the regulation within one year of its publication. Article 7(2) lets CITRA issue instructions or guidance on data privacy whenever necessary.
Article 7(3) provides that, where a violation of the regulation or of Kuwait's laws is established, CITRA may apply the penalties and fines provided in Law No. 37 of 2014 establishing the Communications and Information Technology Regulatory Authority, as amended by Law No. 98 of 2015.
Article 37 of the Electronic Transactions Law (Law No. 20 of 2014) criminalises illegitimately logging in to an electronic data processing system, preventing access to it, damaging it, or obtaining credit-card or other electronic-card numbers from it, with imprisonment of up to three years and a fine of between five thousand and twenty thousand Kuwaiti dinars; on a plain reading, none of those four acts describes a scraper reading a public, unauthenticated page without defeating a security measure.
Two further named leads for this topic, the Cybercrime Law (Law No. 63 of 2015 on Combating Information Technology Crimes) and the Copyright Law (Law No. 75 of 2019 on Copyright and Related Rights), are not addressed here: the only located copy of the Cybercrime Law requires a paid subscription that shows its title and table of contents but not its articles, and the only located copy of the Copyright Law is an Official Gazette scan whose extracted text is too corrupted, with letters missing from ordinary words, to support a quoted provision.
Article 37 criminalises, for any person, deliberately and illegitimately logging in to an electronic data processing system, preventing access to it, causing it damage, or obtaining credit-card or other electronic-card numbers from it to steal funds, alongside separate clauses on unlicensed electronic-authentication services and forged or defective electronic signatures.
The offence carries imprisonment of up to three years and a fine of between five thousand and twenty thousand Kuwaiti dinars, or either penalty. The public prosecution alone has jurisdiction to investigate and pursue the offence, so it creates no private civil claim. Article 46 provides that the Law is published and takes effect from the date the executive regulation is approved, and no official source for that approval date has been located.
Kuwait's one located standalone security-baseline instrument is the Data Classification Policy (version 2.3), issued by the Communication and Information Technology Regulatory Authority (CITRA) and listed among CITRA's own 'Regulations and Decisions' with a listing date of .
The policy describes its own scope as a methodology for data classification for the public and private sectors, and directs 'the data owner', any individual, government entity, or private company that owns data and has authority to process it, to classify all digital data it holds into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, and Highly Sensitive Data), with entities of a security or military nature excluded from the four-tier scheme and free to classify their own data as they see fit.
Once classified, the data owner must encrypt Tier 3 and Tier 4 data during transmission between locations, maintain a unified data catalog with metadata standards, and ensure Tier 3 and Tier 4 data is transferred off or removed from a data center's or server's storage before that equipment is decommissioned.
The policy also assigns roles: senior management must form a data classification team headed by the entity's Director of Information Security and Director of Information Technology alongside the departments that own data, direct employees to report any breach of the policy immediately, and record breaches with corrective action taken; CITRA's own role is to issue related guidelines, monitor public and private sector compliance, and coordinate with the Central Agency for Information Technology (CAIT) for quarterly compliance reporting from government entities.
No penalty, civil or criminal, for a private sector data owner's non-compliance appears anywhere in the policy's own text, so the instrument, read in full, stands as researched but toothless on its own; whether CITRA's general regulatory or licensing power under its establishment law (Law No. 37 of 2014, as amended by Law No. 98 of 2015) separately supplies a sanction was not independently traced.
CITRA's 'Laws and Regulations' index lists further resolutions and decisions across additional pages beyond the one read here; the visible page, sorted newest first back to March 2022, names no other title suggesting a product-security, vulnerability-reporting, or further baseline-security regulation beyond the Data Classification Policy. Whether an earlier or later regulation on an unread page carries one could not be confirmed and is recorded here as a gap, not as a finding that none exists.
CITRA separately runs a 'Cybersecurity and Emergency Response' programme naming a National Cybersecurity Strategy for the State of Kuwait (2017-2020), a set of pandemic era circulars (a security policy for operating electronic applications during the COVID-19 emergency, security controls for remote work during the pandemic, a joint initiative with Cisco Systems to secure government remote work), and a general 'application security service'; none of these reads as a currently binding, generally applicable regulation, and no product-security or incident-reporting duty running to a private business on any clock was found among them.
The Central Bank of Kuwait (CBK) separately operates a Cyber and Operational Resilience Framework (CORF), which CBK's own page describes as the next evolution from the 'foundational cybersecurity compliance' its earlier Cybersecurity Framework (2020) established, moving to a 'Resilience-first' and 'Maturity-oriented' regulatory model from 2025.
It binds CBK's own 'Regulated Entities': Kuwaiti banks (conventional, Islamic, and specialized) and foreign bank branches, finance companies, investment companies, exchange companies, credit information companies, and e-payment companies, providers, and operators. The Cyber and Operational Resilience Framework's security and incident-reporting duties, and Circular 527/2023's minimum cybersecurity requirements for e-payment and e-money providers, are filed as rows of their own.
Kuwait's Cybercrime Law (Law No. 63 of 2015 on Combating Cybercrimes) is already this jurisdiction's scraping topic instrument for its unauthorized access offences. Its table of contents lists only two chapters, Definitions (Article 1) and Offences and Penalties (Articles 2 through 21), with no separate chapter of operator facing duties, confirming no additional security topic provision sits inside it beyond what the scraping topic already holds.
The Electronic Transactions Law (Law No. 20 of 2014, as later amended by Decree Law No. 148 of 2025), also already the scraping topic's instrument for its own unauthorized access provision, runs eight chapters; its only security adjacent language sits in Chapter Seven, 'Privacy and Data Protection' (Articles 32 through 36), where Article 36 requires the bodies holding the personal data Article 32 registers to take the appropriate measure to protect that personal data and information against loss, damage, disclosure, replacement with incorrect data or information, or addition of untrue information, a controller's safeguards clause addressed to personal data inside a privacy chapter rather than a standalone security duty, the same shape as General Data Protection Regulation (GDPR) Article 32, so it belongs with this jurisdiction's privacy row rather than being filed here a second time.
The same Law's electronic payment chapter (Article 31) gives the Central Bank authority to issue instructions to banking and financial institutions on electronic payment regulation, consistent with the statutory root of CBK's CORF and its predecessor Cybersecurity Framework named above.
CITRA's own Data Privacy Protection Regulation, already this jurisdiction's privacy topic instrument, could not be independently re-read here to check for a further, separable security duty beyond its data protection safeguards clause: its PDF returned no extractable text when read, a known extraction limit rather than evidence the document does not exist, so that check from the topic checklist's sixth dimension was not completed.
The Central Bank of Kuwait's Cyber and Operational Resilience Framework, version 1.0, applies to all Regulated Entities under its supervision and sets out their cyber resilience baselines, statement of applicability and risk profile duties. The Framework requires a Regulated Entity to report a high severity incident to the Central Bank of Kuwait within 1 hour of discovery and a medium severity incident within 4 hours.
Circular No. (2/PS/527/2023) of the Central Bank of Kuwait sets minimum cybersecurity and business continuity requirements for all e-payment and e-money service providers.
Circular No. (2/PS/527/2023) of the Central Bank of Kuwait Minimum Cybersecurity and Business Continuity Requirements, under Article 28 of the Instructions Regulating the Electronic Payment of FundsCircular No. (2/PS/527/2023) of the Central Bank of Kuwait, published in its Circulars for Regulating the Electronic Payment of Funds
In force.Binds private bodies.
What this law does
Circular No. (2/PS/527/2023) applies to all E-Payment Service Providers and E-Money Service Providers, both current and newly established. Large providers must keep cybersecurity and information technology tasks separate and create an information security position independent of information technology. Information security, business continuity and crisis management policies, measures and plans must be approved and signed by the provider's higher management.
A provider that keeps record of or processes bank card data must obtain PCI-DSS certification approved by a third party and renew it regularly. The Central Bank of Kuwait must be notified where the PCI-DSS certification is revoked or fails to be renewed for any reason. A third party must conduct comprehensive security assessment tests of the product or service before launch, and every observation in its report must be addressed under a clear plan.
Article 28 of the Instructions Regulating the Electronic Payment of Funds requires activity services providers to implement the instructions the Central Bank of Kuwait issues in relation to cybersecurity. Article 45 of the Instructions applies the penalties under Article 85 of Law No. 32 of 1968 or Article 15 of Law No. 106 of 2013, as the case requires, to activity services providers.
The Cyber and Operational Resilience Framework applies to all Regulated Entities under the supervision of the Central Bank of Kuwait. The Statement of Applicability is a mandatory submission required from all Regulated Entities under the supervision and oversight of the Central Bank of Kuwait. The inherent risk profile is mandatory for all Regulated Entities and is updated annually or upon significant changes to operational, technological or organizational landscape.
Compliance with the circulars the Central Bank of Kuwait issues under the Framework is mandatory to all Regulated Entities. The Cyber Resilience Baselines define the foundational controls and minimum requirements that Regulated Entities are expected to implement under the Framework. The Framework cites Article 15 of Law No. 32 of 1968 as the mandate under which the Central Bank of Kuwait regulates and oversees the banking sector.
Article 85 of Law No. 32 of 1968 lets the Central Bank of Kuwait impose financial penalties of up to fifty thousand Dinars on a bank that violates the decisions and instructions issued under that Law. The Framework records version 1.0 as the first release by the Central Bank of Kuwait, dated .
This policy outlines a methodology for data classification for the public and private sectors. The data owner shall classify their data into at least four levels. Entities of a security or military nature of the country are excluded from adherence to the classification levels specified in this policy, and they have the option to classify their data as they see appropriate.
The data owner must encrypt all classified data that falls under Tier 3 and Tier 4 during transmission from one government entity to another, or when transmitted between different physical geographical locations of government entities; this applies to the private sector as well.
The data owner must ensure that all data classified according to the third and fourth levels are transferred or removed from data centers and servers before the disposition of the equipment of data centers and servers hosting the data. The data owner is required to create and maintain a data catalog which should include the metadata information and standards for its data in a unified format. This catalog should also be updated periodically.
The entity or company must form a data classification team headed by the senior management or their representatives, with the membership of each of the director of information security department, the director of the information technology department, in addition to the directors of the various departments who own data, whether the data is personal and pertains to subscribers or it is the entity or company data.
Directing the entity's employees to immediately report any breach in the implementation of this policy. Record breaches and take corrective actions. Issue policies and guidelines related to information and communication technology. Monitor the public and private sectors entities in implementing the policies and guidelines issued by the authority to ensure compliance.
Request periodic reports from the Central Agency for Information and Technology (CAIT) to analyze and measure the compliance and implementation of government entities with this policy. No penalty, civil or criminal, for non-compliance appears anywhere in the policy's own text.
The Framework applies to all Regulated Entities under the supervision of the Central Bank of Kuwait. Regulated Entities must initially report a medium severity incident to the Central Bank of Kuwait within 4 hours of discovery and a high severity incident within 1 hour of discovery. Regulated Entities must update the Central Bank of Kuwait on a medium severity incident daily or when requested by the Central Bank of Kuwait.
Regulated Entities must update the Central Bank of Kuwait on a high severity incident every 4 hours from prior notification or when requested by the Central Bank of Kuwait. Regulated Entities must submit a closure report once a medium or high severity incident is resolved, and report low severity incidents consolidated on a monthly basis. Regulated Entities must determine the estimated financial loss in the initial situational report and confirm the final loss amount in the closure report. Regulated Entities must report incidents in accordance with the predefined templates and communication channels.
Kuwait has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining regime, and no hot-news or misappropriation doctrine distinct from ordinary copyright law.
The general copyright framework, Law No. 75 of 2019 on Copyright and Related Rights, art. 31, permits quotation of passages from a published work in another work, consistent with fair practice, non-substantial in extent and to the extent justified by the purpose, with the source and author's name cited, and states that this reaches press summaries taken from newspapers and periodicals.
Article 31 separately permits, without the author's permission, transferring or copying newspaper and periodical articles on current topics (or broadcast works of a similar character) with clear source and author attribution where known, and permits newspapers, periodicals, and broadcasting entities to publish excerpts from an author's lawfully available works and published articles on matters of current public interest without permission or compensation, subject to source attribution, unless the author prohibited this at the time of publication.
Neighbouring rights under the same law, read elsewhere in its text, run to performers rather than to a print or online news publisher, so no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates was located. No provision addressing a machine-readable text-and-data-mining reservation, or the status of a hyperlink as a communication to the public, was located in the reviewed text.
Article 31 opens by permitting a third party to use a work in certain special cases without the author's permission or compensation, with no restriction to a private or government actor.
Article 31, second, permits quotation of passages from a published work in another work provided the quotation is consistent with fair practice, non-substantial, extends only as far as the purpose justifies, and cites the source and author's name; the same clause states that this reaches press summaries taken from newspapers and periodicals.
Article 31, seventh, permits transferring or copying newspaper and periodical articles on current topics, or broadcast works of a similar character, without the author's permission, provided the source is clearly cited and the author's name if known.
Article 31, twentieth, permits newspapers, periodicals, and broadcasting entities to publish excerpts from an author's works lawfully made available to the public and his published articles on matters occupying public opinion at a given time, without permission or compensation, provided the source is cited, unless the author prohibited this at the time of publication.
Article 51 directs the ministers to implement the Law and orders its publication in the Official Gazette, and the Law's text states no day on which it comes into force.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Kuwait has no AI-transparency, synthetic-content-labelling, or bot-disclosure law in force. Five members of the National Assembly submitted a bill in December 2023 to establish a Public Authority for Artificial Intelligence (PAAI), a government regulator that would license AI developers, set national AI strategy, and issue AI governance regulations; this visit found no report of the bill reaching a vote or coming into force.
Kuwait's Electronic Transactions Law, Law No. 20 of 2014, gives legal effect to a contract concluded between two automated electronic systems that are pre-programmed to carry out such tasks without the direct intervention of a natural person at the time of the transaction, but this is a general commercial-law recognition of automated dealing rather than an AI-transparency, risk-obligation, training-data, prohibited-practice, governance, or sector-specific duty of the kind this topic tracks.
As of .
Age gating law
Kuwait has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.
Law No. 61 of 2007 on Audiovisual Media is a broadcast-licensing statute for television and radio channels; its licensee and channel-manager age requirement (thirty years or older) binds the license applicant, not the audience, and its content restrictions (art. 11) address religion, public order, and personal reputation rather than a minor-specific verification or design duty.
Law No. 8 of 2016 Regulating Electronic Media, a licensing regime for professionally-run electronic news outlets and media websites that expressly excludes a personal, non-professional account (art. 5), imports the same general content restrictions from Law No. 3 of 2006 and Law No. 61 of 2007 (art. 18) and adds a right-of-reply duty (art. 17), again without a minor-specific verification or design duty.
Law No. 21 of 2015 on the Rights of the Child, art. 88, criminalizes using a computer, the internet, or an information network to prepare, possess, display, print, publish, or promote child sexual abuse material, and art. 92 penalizes publishing an at-risk or offending child's identifying information through a media outlet; both bind any person as a general criminal prohibition rather than imposing a verification or design duty on a covered service.
As of .
Case law
No current case law for Kuwait AI law
No current case law for Kuwait privacy law
No current case law for Kuwait scraping law
No current case law for Kuwait cybersecurity law
No current case law for Kuwait communications law
No current case law for Kuwait content moderation law
No current case law for Kuwait product and AI liability law
No current case law for Kuwait digital accessibility law
No current case law for Kuwait age gating law
No current case law for Kuwait reuse law
Reporting clocks that run here2 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Kuwait comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Report a high severity incident to the Central Bank of Kuwait within 1 hour of discovery and a medium severity incident within 4 hours of discovery (Chapter 5, section 8.2.2.1).
Update the Central Bank of Kuwait on a high severity incident every 4 hours from the prior notification and on a medium severity incident daily, or when it asks (section 8.2.2.2).
Notify CITRA of a personal data breach within 24 hours after becoming aware of it, through CITRA's official channels of communication, stating the nature and extent of the breach, the persons and security levels affected, the data protection officer's name and contact, and the likely consequences and the measures taken or proposed (Article 6).
Where an incorrect disclosure of stored user data, or access to it, seriously harms a large number of users, notify CITRA, the users and law enforcement as soon as possible and in any case within 72 hours (Article 4).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
