Home › Law library › Kuwait DPPR
KW
Kuwait DPPR
Data Privacy Protection Regulation (CITRA Resolution No. 26 of 2024)
Sourced · 3/14 facts confirmed by two sources. Last verified 3 November 2026
Next full re-check due: . Regulator news is checked monthly; changes are logged in the change log.
Early-stage page. Fewer than half of the facts below have been cross-checked against a second source yet. Use it as a starting point and check the official text before relying on it.
Cite this page: GlanceDesk Jurisdiction, “Kuwait DPPR (Kuwait)”, glancedeskjurisdiction.com/laws/kw-dppr, last verified 3 November 2026.
Kuwait Privacy
- Status
- Issued by CITRA Resolution No. 26 of 2024 of 7 February 2024 (regulation version 2.5, approved by CITRA's Board on 5 December 2023), in force from its publication in the Official Gazette and on CITRA's website, where CITRA posted it on 18 February 2024. It repeals Resolution No. 42 of 2021 and its amendments. Licensees had one year from publication to comply (Art. 7(1)).✓
- Who it applies to
- Every service provider licensed by CITRA that collects, processes or stores users' personal data and content, in whole or in part, by automated or other means, whether the processing takes place in Kuwait or abroad (Art. 1). A service provider is a person licensed to provide telecommunications services to the public or to run a telecommunications network or internet service, including information and content providers that serve through a telecommunications network (definitions). It does not cover security investigations, monitoring of violations, court decisions or financial claims under the subscription contract (Art. 1).
- Size thresholds
- No size, turnover or data-volume threshold: the test is holding a CITRA licence (Art. 1). Collecting data of a person under 18 needs the written consent of a guardian (Art. 3(5)).
- Regulator
- The Communication and Information Technology Regulatory Authority (CITRA), set up by Law No. 37 of 2014 as amended by Law No. 98 of 2015, which may issue privacy instructions and guidance (Art. 7(2)).✓
- Breach or incident reporting
- Notify CITRA through its official channels within 24 hours of becoming aware of a personal data breach, stating the nature of the breach, the people and data affected, the data protection contact, the likely consequences and the measures taken (Art. 6(1) and (2)), and notify the data subjects (Art. 6(3)) unless technical and organisational protection had been applied to the affected data (Art. 6(4)). Separately, if stored data is wrongly disclosed and seriously harms many users, notify CITRA, the users and law enforcement as soon as possible and within 72 hours at most (Art. 4(15)).
- Deadline to answer personal data requests
- No deadline is set. Licensees must give users an easy way to access, correct and erase their data, restrict or object to its processing, move it and withdraw consent (Art. 4(8) and 4(12)), and run internal systems that receive complaints and access, correction and erasure requests around the clock (Art. 5(9)).
- Data protection officer
- No express duty to appoint one, but the records of processing must give the contact details of the data protection officer (Art. 5(4.1)) and a breach notice names how to reach the data protection officer (Art. 6(2.2)).
- Local representative
- The records of processing must name the provider's representative if the provider is outside Kuwait (Art. 5(4.1)); there is no separate rule on appointing one.
- Sending data abroad
- Allowed without approval. Tell users where their personal data is stored, in or outside Kuwait (Art. 4(7)), tell the data subject before transferring their data outside Kuwait (Art. 4(9)), and record transfers and the destination country (Art. 5(4.4)).
- Cookies and consent
- Processing is lawful only with the user's consent, to meet a legal obligation of the provider, to protect the user's data, where the service needs to identify the data subject, or with a guardian's written consent for a person under 18; the provider must be able to prove consent (Art. 3). Before the service starts, give the terms in plain Arabic and English, get consent and state the purpose (Art. 2). Get consent before disclosing data to a third party for marketing unrelated to the service (Art. 4(11)). There is no cookie-specific rule.
- Maximum penalty
- The regulation applies the penalties of Law No. 37 of 2014 (Art. 7(3)). Under its Article 64, CITRA may warn the violator to fix the violation within 30 days, suspend the licence for 3 months, cut services or the licence term, cancel the licence, or impose up to KWD 1,000,000 per violation, doubled for a repeat (CITRA's English copy of the law).
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do
- Before service, give the terms in plain Arabic and English, get consent and state the purpose (Art. 2).
- Process only on a lawful basis, such as consent or a legal obligation, and keep proof of consent (Art. 3).
- Publish a written privacy policy and design services for privacy (Art. 4(14) and 4(16)).
- Keep records of processing, including transfers abroad, and show them to CITRA on request (Art. 5(4) and 5(5)).
- Report a personal data breach to CITRA within 24 hours and tell the people affected (Art. 6).
Recent changes
CITRA Resolution No. 26 of 2024 (7 February 2024) replaced Resolution No. 42 of 2021 and its amendments, including Resolution No. 244 of 2023, with the Data Privacy Protection Regulation version 2.5, which sets the 24-hour breach notice (Art. 6).✓
Sources
- Primary source: https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- Second source: https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%82%D8%B1%D8%A7%D8%B1%2026%20%D8%A8%D8%B4%D8%A3%D9%86%20%D8%A7%D9%95%D8%B5%D8%AF%D8%A7%D8%B1%20%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- Regulator: The Communication and Information Technology Regulatory Authority (CITRA), set up by Law No. 37 of 2014 as amended by Law No. 98 of 2015, which may issue privacy instructions and guidance (Art. 7(2)).
Sources used for the independent check (4)
- https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%82%D8%B1%D8%A7%D8%B1%2026%20%D8%A8%D8%B4%D8%A3%D9%86%20%D8%A7%D9%95%D8%B5%D8%AF%D8%A7%D8%B1%20%D9%84%D8%A7%D9%8A%D9%94%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf
- https://www.citra.gov.kw/sites/en/LawofCITRA/Law%20No.%2037-%202014.pdf
- https://www.citra.gov.kw/sites/ar/Pages/regulations.aspx
= confirmed by two independent sources, at least one official. How we verify
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@