Kuwait. Sectoral privacy. Regulation (administrative decision)
Kuwait DPPRCITRA Data Privacy Protection Regulation (Administrative Decision No. 26 of 2024)
In force
Partly verified
Medium confidence.Issuance date not verified; 'replaces 2021 decision' from prior knowledge.
§1Summary
- Synopsis
Kuwait has no general data protection law; this CITRA regulation imposes data protection duties on licensed telecom service providers, defined broadly to include those running websites, apps or cloud services that handle personal data.
- Key themes
- Unique features
Very short 24-hour breach notification to both CITRA and affected users; providers must disclose destination countries of transfers.
- SaaS relevance
A cloud or app-based SaaS licensed by or operating under CITRA in Kuwait can fall within the broad 'service provider' definition.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- CITRA and users within 24h
- DPO
- Conditional
- Cross-border transfers
- Disclosure of transfers and destination countries; no adequacy regime
- Maximum penalty
- Per CITRA law: 1–5 years' imprisonment and/or KWD 500–20,000
§3Dates
- Key dates
- Adopted
- In force
- Replaces CITRA Decision 42 of 2021
§4Text and authority
- Text
- Authoritative text citra.gov.kw
- Authority
- Communications and Information Technology Regulatory Authority (CITRA)
§5Where it applies
- Domestic law of
- Kuwait
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Issuance date not verified; 'replaces 2021 decision' from prior knowledge.