KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammed Nader Al Awadhi and Liana Rashid, GLA & Company
GLA & Company Alex Saleh Managing Partner Tel: Kuwait: +(965) 669 55516 UAE: +(971) 54 997 4040 Email: alex.saleh@glaco.com Web: glaco.com/attorneys/alex-saleh/
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Kuwait does not have a single, state-wide data pro - tection statute; instead, privacy and data protection are governed by a mix of e-transaction rules, sectoral telecom rules, cloud guidance, cybercrime provisions and general media/content controls issued by respec - tive data control authorities in Kuwait. The principal instruments are the Electronic Transac - tions Law No 20 of 2014 (the “E-Transactions Law”) and its Executive Regulations (Decision No 48 of 2014) governing collection, use, disclosure, security and data subject rights for electronic records handled by public authorities and private entities, including consent and purpose specification for access/disclo - sure and duties to ensure accuracy and safeguards for personal data in electronic systems. Furthermore, the Cybercrime Law No 63 of 2015 criminalises unau - thorised access, alteration, disclosure and destruction of data (including personal and governmental data), with escalating penalties depending on the nature of the systems and data affected. Telecom-sector privacy is governed by the Kuwait Communication and IT Regulatory Authority (CIT - RA) Data Privacy Protection Regulation (DPPR), as amended by Decision No 26 of 2024, which now applies exclusively to CITRA-licensed telecom and internet providers (the “Licensees”) and imposes consent, transparency, security, transfer notice and breach notification duties on those Licensees. Addi - tional instruments include CITRA’s Users’ Rights Pro -
tection and Regulation of Communications and IT Services (the “User Guidelines”) and CITRA’s Cloud Computing Regulatory Framework (v2.4) (the “Cloud Framework”), which prescribe collection/disclosure practices, security and transparency for Licensees and licensed cloud service providers (CSPs) operat - ing data centres in Kuwait. Additionally, the CITRA Law No 37 of 2014 (establish - ing CITRA), the Electronic Media Law No 8 of 2016 (regulating certain online publishers), and content blocking powers under press, cybercrime and telecom statutes interact with privacy by limiting certain data/ content uses on public order and security grounds. In terms of multi-level interaction, Kuwait’s framework is domestic and not tied to supranational regimes like the EU’s GDPR, and overlap occurs horizontally between general e-transaction obligations, cyber - crime provisions and sector-specific telecom/cloud rules, with the E-Transactions Law acting as a gen - eral baseline and the DPPR/User Guidelines apply - ing only to Licensees. That being said, certain rules have extraterritorial reach. For Licensees, the DPPR expressly captures data collection/processing per - formed inside or outside Kuwait, and requires trans - parency regarding transfers abroad. For other Kuwait entities, cross-border data handling defaults to the consent, purpose limitation and security duties under the E-Transactions Law. Kuwait has not enacted a comprehensive AI law, and governance of AI-related personal data is there - fore derived from the above instruments. There is no equivalent to the EU’s European Health Data Space
261 CHAMBERS.COM
Powered by FlippingBook