الصفحة الرئيسية › مكتبة القوانين › Kuwait DPPR
KW
Kuwait DPPR
Data Privacy Protection Regulation (CITRA Resolution No. 26 of 2024)
موثّق المصدر · 3/14 معلومات مؤكَّدة من مصدرين. آخر تحقق 3 نوفمبر 2026
موعد المراجعة الكاملة التالية: . نتابع أخبار الجهات الرقابية شهريًا، وتُسجَّل التغييرات في سجل التغييرات.
صفحة في مرحلة مبكرة. تم التحقق حتى الآن من أقل من نصف الحقائق أدناه مقابل مصدر ثانٍ. استخدمها نقطة بداية وراجع النص الرسمي قبل الاعتماد عليها.
الاستشهاد بهذه الصفحة: GlanceDesk Jurisdiction, “Kuwait DPPR (Kuwait)”, glancedeskjurisdiction.com/laws/kw-dppr, last verified 3 November 2026.
Kuwait الخصوصية
- الحالة
- Issued by CITRA Resolution No. 26 of 2024 of 7 February 2024 (regulation version 2.5, approved by CITRA's Board on 5 December 2023), in force from its publication in the Official Gazette and on CITRA's website, where CITRA posted it on 18 February 2024. It repeals Resolution No. 42 of 2021 and its amendments. Licensees had one year from publication to comply (Art. 7(1)).✓
- على من ينطبق
- Every service provider licensed by CITRA that collects, processes or stores users' personal data and content, in whole or in part, by automated or other means, whether the processing takes place in Kuwait or abroad (Art. 1). A service provider is a person licensed to provide telecommunications services to the public or to run a telecommunications network or internet service, including information and content providers that serve through a telecommunications network (definitions). It does not cover security investigations, monitoring of violations, court decisions or financial claims under the subscription contract (Art. 1).
- حدود الحجم
- No size, turnover or data-volume threshold: the test is holding a CITRA licence (Art. 1). Collecting data of a person under 18 needs the written consent of a guardian (Art. 3(5)).
- الجهة الرقابية
- The Communication and Information Technology Regulatory Authority (CITRA), set up by Law No. 37 of 2014 as amended by Law No. 98 of 2015, which may issue privacy instructions and guidance (Art. 7(2)).✓
- الإبلاغ عن الخروقات أو الحوادث
- Notify CITRA through its official channels within 24 hours of becoming aware of a personal data breach, stating the nature of the breach, the people and data affected, the data protection contact, the likely consequences and the measures taken (Art. 6(1) and (2)), and notify the data subjects (Art. 6(3)) unless technical and organisational protection had been applied to the affected data (Art. 6(4)). Separately, if stored data is wrongly disclosed and seriously harms many users, notify CITRA, the users and law enforcement as soon as possible and within 72 hours at most (Art. 4(15)).
- مهلة الرد على طلبات البيانات الشخصية
- No deadline is set. Licensees must give users an easy way to access, correct and erase their data, restrict or object to its processing, move it and withdraw consent (Art. 4(8) and 4(12)), and run internal systems that receive complaints and access, correction and erasure requests around the clock (Art. 5(9)).
- مسؤول حماية البيانات
- No express duty to appoint one, but the records of processing must give the contact details of the data protection officer (Art. 5(4.1)) and a breach notice names how to reach the data protection officer (Art. 6(2.2)).
- الممثل المحلي
- The records of processing must name the provider's representative if the provider is outside Kuwait (Art. 5(4.1)); there is no separate rule on appointing one.
- نقل البيانات إلى الخارج
- Allowed without approval. Tell users where their personal data is stored, in or outside Kuwait (Art. 4(7)), tell the data subject before transferring their data outside Kuwait (Art. 4(9)), and record transfers and the destination country (Art. 5(4.4)).
- ملفات تعريف الارتباط والموافقة
- Processing is lawful only with the user's consent, to meet a legal obligation of the provider, to protect the user's data, where the service needs to identify the data subject, or with a guardian's written consent for a person under 18; the provider must be able to prove consent (Art. 3). Before the service starts, give the terms in plain Arabic and English, get consent and state the purpose (Art. 2). Get consent before disclosing data to a third party for marketing unrelated to the service (Art. 4(11)). There is no cookie-specific rule.
- أقصى عقوبة
- The regulation applies the penalties of Law No. 37 of 2014 (Art. 7(3)). Under its Article 64, CITRA may warn the violator to fix the violation within 30 days, suspend the licence for 3 months, cut services or the licence term, cancel the licence, or impose up to KWD 1,000,000 per violation, doubled for a repeat (CITRA's English copy of the law).
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
ما يجب عليك فعله
- Before service, give the terms in plain Arabic and English, get consent and state the purpose (Art. 2).
- Process only on a lawful basis, such as consent or a legal obligation, and keep proof of consent (Art. 3).
- Publish a written privacy policy and design services for privacy (Art. 4(14) and 4(16)).
- Keep records of processing, including transfers abroad, and show them to CITRA on request (Art. 5(4) and 5(5)).
- Report a personal data breach to CITRA within 24 hours and tell the people affected (Art. 6).
التغييرات الأخيرة
CITRA Resolution No. 26 of 2024 (7 February 2024) replaced Resolution No. 42 of 2021 and its amendments, including Resolution No. 244 of 2023, with the Data Privacy Protection Regulation version 2.5, which sets the 24-hour breach notice (Art. 6).✓
المصادر
- المصدر الأساسي: https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- المصدر الثاني: https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%82%D8%B1%D8%A7%D8%B1%2026%20%D8%A8%D8%B4%D8%A3%D9%86%20%D8%A7%D9%95%D8%B5%D8%AF%D8%A7%D8%B1%20%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- الجهة الرقابية: The Communication and Information Technology Regulatory Authority (CITRA), set up by Law No. 37 of 2014 as amended by Law No. 98 of 2015, which may issue privacy instructions and guidance (Art. 7(2)).
المصادر المستخدمة في التحقق المستقل (4)
- https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%82%D8%B1%D8%A7%D8%B1%2026%20%D8%A8%D8%B4%D8%A3%D9%86%20%D8%A7%D9%95%D8%B5%D8%AF%D8%A7%D8%B1%20%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- https://www.citra.gov.kw/sites/en/LawofCITRA/Law%20No.%2037-%202014.pdf
- https://www.citra.gov.kw/sites/ar/Pages/regulations.aspx
= مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق
معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على contact@