🇰🇼Data Privacy Protection Regulation, 2024
A service-provider privacy regulation, not a general GDPR clone
Kuwait's Data Privacy Protection Regulation, issued by CITRA, is a targeted privacy instrument for communications and information technology service providers. It is not structured like the GDPR and it does not apply in the same way as broad national data protection statutes. Its centre of gravity is the relationship between a service provider and the users whose personal data is collected, processed, stored, transferred or monitored through communications and IT services.
The regulation is practical and operational. It tells service providers what they must explain before service delivery, when consent is required, how privacy notices and policies must be presented, what rights users must be able to exercise, how security must be designed, what records must be kept, and how quickly breaches must be reported. For covered providers, compliance is therefore not just a website privacy policy. It is a set of controls across service onboarding, data processing, security, outsourcing, marketing and incident response.
Who the regulation covers — and why scope matters
The regulation defines CITRA as the Communication and Information Technology Regulatory Authority established under Law No. 37 of 2014 and its amendments and executive regulations. It defines a Communications and Information Technology Service Provider broadly to include a natural or legal person who provides communications and information technology services in Kuwait, provides or manages a public communications network, operates a website, smart application or cloud computing service, collects or processes personal data, or directs another party to collect and process personal data on its behalf through information centres owned or used directly or indirectly.
Article 1 applies the regulation to public and private sector service providers who collect, process and store personal data and user-related content, in whole or in part, permanently or temporarily, using automated means or other means that are part of a data storage system. It also applies whether processing occurs inside or outside Kuwait where it relates to processing activities linked to transmission of advertising or marketing material or monitoring the behaviour and tendencies of data owners.
Article 2 excludes natural persons who collect and process personal and family data. It also excludes security authorities where processing is for crime prevention, investigation, discovery, prosecution, enforcement of criminal penalties, or prevention of threats to public security. These exclusions should be read narrowly. They do not create a general exemption for commercial platforms or IT service providers.
Personal data — broad enough to cover identity, location, biometrics and voice
The regulation defines personal data as data relevant to a natural or legal person whose identity is identified or can be identified through that data. The examples are broad: name, identity, financial information, health information, racial or religious information, data that identifies geographical location, personal tracking systems, fingerprint or genetic fingerprint, combinations of available data, audio files including a person's voice, and any other identifier that allows physical or online contact with the person.
This makes the regulation especially relevant for digital services. A provider handling account identifiers, device identifiers, location data, behavioural monitoring, biometric authentication, call records, voice data or marketing profiles may be handling personal data even when the data is not limited to a user's civil identity number or formal account record.
The regulation also defines data collection and processing broadly. Processing includes collecting, recording, organising, analysing, storing, modifying, retrieving, using, disclosing through transmission and posting, making available, merging, restricting, deleting and destroying personal data. The definition applies whether processing is inside or outside Kuwait and whether automated or not.
Consent and lawful processing — consent is the starting point
Article 4 requires service providers, before providing the service, to provide information and service conditions in easy terms in both English and Arabic, including requests to change or delete data. It also requires the provider to obtain the service applicant's consent to collect or process personal data and to clarify the purpose for which user data is collected and how it may be used.
Article 5 states that data processing is lawful and legitimate only where one or more conditions is available. These include consent of the data owner, necessity to comply with a legal obligation to which the communications and IT service provider is subject, necessity to protect the natural or legal person's data, cases where the service provider's objectives do not require identification of the data owner's identity, and explicit guardian consent for a child below 18 years of age.
The regulation also makes consent accountable. The service provider must be able to demonstrate that the data owner agreed to the processing. The data owner may withdraw consent at any time, and withdrawal does not affect the legality of processing before withdrawal. The provider must facilitate withdrawal as easily as consent was obtained. Where the data owner requests withdrawal and destruction of previously processed data, the provider must destroy such data from hardware devices and logs and refrain from keeping duplicates.
Transparency duties during and after service provision
Article 6 sets out a detailed operational checklist for service providers during or after service provision. The provider must give clear and accessible information about personal data practices and policies, specify the purpose of collection, legal basis and retention period, identify authorities to which personal data is disclosed, and state the identity and location of the service provider, including how to contact it about personal data practices.
The provider must maintain personal data in a form that permits identification of data owners for the relevant processing purposes and must process data in a way that protects it against unauthorised or illegal processing, accidental loss, impairment or damage using appropriate technical and organisational measures.
Article 6 also requires mechanisms that allow individuals to access, review and edit personal data. Providers must provide information about data storage periods and storage location, create mechanisms for obtaining, correcting, deleting, restricting access or processing, objecting to processing, or filing a request for transfer of personal data. They must notify the data owner where the provider intends to transfer personal data outside Kuwait in accordance with CITRA's data classification policy, and must inform the data owner before further processing personal data for purposes other than those for which it was collected.
A cloud application provider serving Kuwaiti users obtains consent during onboarding and publishes a privacy policy. But when users try to withdraw consent, the process requires customer support escalation and the data remains in logs and backup systems. Under the CITRA regulation, the issue is not only whether consent was obtained. The provider must facilitate withdrawal, support deletion where requested, destroy processed data from hardware devices and logs where required, and refrain from keeping duplicates. A consent banner alone does not satisfy that operating requirement.
Privacy policy, privacy notice and marketing controls
The regulation requires each communications and information technology service provider to create and maintain a written privacy policy. The policy must establish in detail the provider's processes and procedures for collecting, using and disclosing personal information, including how the provider will comply. It must be posted on the service provider's website and provided to users when they subscribe to the services.
Providers must also issue a privacy notice informing customers clearly and accurately about the personal information collected, used and stored, and the circumstances in which it is shared with other entities. The notice must inform users of their right to consent, withdraw approval or cancel use of end-user personal information. It must also provide an option for users not to receive email, text message or phone call marketing communications if they do not wish to receive them.
The privacy notice must be announced on the website in a manner visible to a sensible person, merged as part of online applications and transaction forms, and made available at points of sale. Providers must give users prior notice of any fundamental change in privacy policies.
Third parties, affiliates and processor controls
The regulation expects service providers to control third-party handling. Persons engaged in collecting, handling or using personal information must be fully informed and trained on the licensee's security and privacy practices, whether they work for the provider or for a third party contracted to collect or process users' personal data.
Where it is necessary to provide personal information to affiliates or other third parties to deliver a service, the licensee must ensure, through contractual means, that subsidiaries and other parties take all necessary steps to protect confidentiality, security and use personal information solely for the purpose of providing the required service.
The regulation also restricts marketing disclosure. The provider must obtain the data owner's consent before disclosing personal data to any subsidiary or third party for marketing purposes that are not directly related to the provision of the requested communications and information technology services.
Security, records and privacy by design
Article 7 requires service providers to establish measures that ensure an appropriate level of protection for risk response, considering the latest technology and the potential risks and impact on the rights and freedoms of natural and legal persons. Measures include processing and encrypting personal data according to mechanisms and standards determined by CITRA and the data classification policy, maintaining continuous confidentiality, integrity, availability and flexibility of processing systems and services, restoring availability and timely access to personal data after force majeure events, and testing and evaluating the effectiveness of technical and regulatory processing-security measures.
Service providers must secure data against accidental or illegal destruction, loss, change, unauthorised disclosure or access. They must comply with CITRA rules or directives regarding business continuity, disaster recovery and risk management. They must also keep records of processing activities, including the service provider's name and contact details, representative details if outside Kuwait, the data protection officer, processing purposes, categories of data owners and personal data, transfers outside Kuwait and the destination country, and a general description of technical and regulatory security measures.
Those records must be made available to CITRA upon request. Providers must develop and follow internal privacy policies, train responsible staff, create internal systems for complaints and access/correction/deletion requests, report procedural breaches, conduct audits and reviews, maintain 24-hour communication with the data protection officer, and provide on-demand advice on data protection impact assessment and monitoring in cooperation with CITRA.
Breach notification — 72 hours to CITRA and affected data owners
Article 8 requires the service provider, within a period not exceeding 72 hours after becoming aware of an incident, to notify CITRA of any personal data breach incident. The notification must include the nature of the breach, extent of leaked data, affected persons, security levels breached, the name and communication mechanism of the data protection officer, possible consequences of the breach, measures taken or proposed to address the penetration, and notification to the personal data owner.
Article 9 requires the provider, upon occurrence of a personal data breach, to notify the personal data owner within a period not exceeding 72 hours after knowledge. The notification must include the nature of the breach and technical protection measures. Notification to the data owner is not necessary where appropriate technical and regulatory protection measures were applied to the affected personal data and subsequent measures ensured that risks to the rights and freedoms of data owners were not escalated.
The regulation also contains a separate 24-hour notification trigger where incorrect disclosure or third-party access causes harm to a large number of users. In that case, the licensee must notify CITRA, end users and law enforcement agencies as soon as possible and no later than 24 hours after reasonably determining that there has been a violation of disclosure or access.
Violating content and general enforcement provisions
Article 10 addresses violating content. Service providers are not responsible for civil, administrative or criminal liability for violating system or user content that infringes third-party intellectual property rights unless the provider becomes aware of it and fails to take appropriate action. Providers may remove or restrict access to such content and must notify CITRA and competent entities without delay if they discover user content or system information that may constitute a violation under the Electronic Crimes Law or applicable Kuwaiti laws.
Article 11 requires all service providers or parties licensed to own public communication networks to reconcile their status with the regulation and related CITRA regulations within one year from the date of publication. CITRA may issue instructions or guidance on data privacy whenever necessary. In the event of a proven violation, CITRA may apply penalties and fines under Law No. 37 of 2014 establishing CITRA, as amended by Law No. 98 of 2015.
Definitions — CITRA, service provider, personal data, data collection and processing, encryption, data centre, third-party content and privacy notice.
Article 1 — Scope: applies to public and private sector service providers processing personal data and user-related content, including certain processing outside Kuwait.
Article 2 — Exclusions: personal/family processing by natural persons and specified security authority purposes.
Article 3 — Data classification: persons contracting with service providers must classify data for information security according to CITRA policy or global best practice.
Articles 4–5 — Collection and lawful processing: clear information, Arabic and English terms, consent, purpose explanation, lawful processing grounds, child guardian consent and withdrawal.
Article 6 — Provider duties: transparency, legal basis, retention, disclosure recipients, access/editing, transfer notice, deletion, privacy policy, privacy notice, marketing opt-out, staff training and privacy by design.
Article 7 — Security: encryption, confidentiality, integrity, availability, resilience, disaster recovery, processing records, internal controls, audits, DPO contact and CITRA access to records.
Articles 8–9 — Breach notification: notification to CITRA and affected data owners within 72 hours, with content requirements and exceptions.
Article 10 — Violating content: removal, restriction and notification obligations for infringing or unlawful content.
Article 11 — General provisions: one-year reconciliation period, CITRA guidance and penalties under the CITRA law framework.
Kuwait's DPPR is an operational rulebook for communications and IT service providers. The practical test is whether the provider can prove consent, explain purposes, support withdrawal and deletion, publish meaningful privacy notices, control marketing use, manage third parties contractually, maintain security and processing records, provide DPO contact, and notify CITRA and affected individuals within the required timelines when a breach occurs. For covered providers, these controls should be built into service onboarding and platform operations, not handled only as legal documentation.