Data Protection and Privacy 2025

KUWAIT Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Mohammad Al Awadhi and Liana Rashid, GLA & Company

Google Cloud has formed this strategic alliance with the government of Kuwait to enhance the country’s digital transformation and support its goal of becoming a data-driven economy. The partnership includes a roadmap for digitalis - ing citizen services and increasing government employee productivity, with a focus on sectors such as healthcare, education, disaster recovery CITRA and the Central Agency for Information Technology (CAIT) are the regulators responsible for overseeing data protection in Kuwait, pursu - ant to the E-Transactions Law and the DPPR. CITRA was established under Law No 37 of 2014 (the “CITRA Law”) and CAIT was established under Law No 266 of 2006 (the “CAIT Law”). 1.3 Enforcement Proceedings and Fines The CITRA Law The CITRA Law empowers CITRA to collect information relevant to the telecommunications and IT sectors, and to issue any reports, bul - letins and guidelines to users. It also prepares the necessary media programmes to increase public awareness of the importance attached to these sectors and the extent of their influence on social and economic development in the State of Kuwait. and smart living. 1.2 Regulators Pursuant to Article 15 of the CITRA Law, all Licensees must adjust their internal policies and rules to any extent necessary to achieve compli - ance with the provisions of the CITRA Law, no more than one year from the date of publica - tion of the CITRA Law’s Executive Regulations. However, under CITRA Decision 68 of 2022, the adjustment period was extended for another 24 months from 13 February 2022.

Pursuant to Article 49 of the CITRA Law, if CIT - RA receives any complaint about a Licensee’s default in the performance of its obligations, a dispute between a Licensee and beneficiary users in relation to the quality and standard of the service being provided or any violations of the licence conditions, CITRA may investigate the complaint and make a decision to either keep the file or notify the Licensee to remove the violation within 90 days. Under Article 52 of the CITRA Law, CITRA must decide with the Licensee on the procedures of any investigations into complaints, as well as the procedures for the Licensee to follow when complaints are received about it. Under Article 54 of the CITRA Law, CITRA must ensure that the Licensee complies with all the provisions of the CITRA Law, and may take any actions it deems necessary in order to do so, such as: • conducting physical examination(s) of the network and telecommunications devices; • examining the Licensee’s technical records to ensure invoices and records are accurate; • assuring the quality of the services and com - plaint procedures provided to clients; and • reviewing the maintenance and failure records of the Licensee to ensure the management service is efficient. Lastly, under the CITRA Law, CITRA must also guarantee compliance with any international, regional and bilateral agreements to which Kuwait is a party.

273 CHAMBERS.COM

Powered by