Kuwait Data Privacy Protection Regulations

Technology, Media & Telecoms Focus

The Communication and Information Technology Regulatory Authority (“CITRA”) of Kuwait has recently issued a new resolution No. 26 of 2024 concerning the issuance of data privacy protection regulations (“Resolution”).Contents

Thank you for reading

Law Update: Issue 368 - Technology, Media & Telecoms Focus

Kuwait Data Privacy Protection Regulations

Lulwa Al Hammad
Senior Associate,
Corporate Commercial

The Communication and Information Technology Regulatory Authority (“CITRA”) of Kuwait has recently issued a new resolution No. 26 of 2024 concerning the issuance of data privacy protection regulations (“Resolution”). IntroductionThe Resolution, which was published in the Official Gazette on February 18, 2024, aims to regulate the data management and processing practices of service providers licensed by CITRA who operate in the field of collecting, processing and storing personal data and the content of user data. The Resolution also seeks to protect the fundamental rights and freedoms of users related to the privacy of their personal data, and to support the development of a strong and competitive industry of communications and information technology services in Kuwait. Who does it apply to?The Resolution applies to all service providers who provide communications and information technology services to the public, whether the processing is carried out inside or outside Kuwait.Main definitionsA “service provider” is defined as a person licensed to provide a service or more of telecommunication services to the public; or licensed to manage, establish or operate a telecommunication network or internet service to provide communication service to the public which includes information or content providers provided through telecommunication network. Further, “personal data” is defined as data related to identified natural or legal person or may be identified based on this data directly, such as identifying the name and identity, financial, health, ethnic, or religious data, or any data that allows to identify the person geographic location, personal fingerprint or genetic fingerprint or, by collecting the available data with any other data, or any audio file including the person voice, and any other identifier that allows Internet contact with the person.Obligations on the Service ProviderAccording to the Resolution, service providers must obtain the consent of the user for the collection or processing of personal data and inform them of the purpose, terms and conditions of the service and data change or cancellation request. The Resolution also specifies the cases in which data collection and processing are lawful and legal, such as complying with a legal obligation, protecting the user data, or identifying the data holder. Further, a requirement is placed on the service providers to collect and process data in a transparent, secure and appropriate manner, and to provide clear and accessible information on their personal data practices and policies.The Resolution also imposes several obligations on service providers to ensure the security and protection of personal data, such as taking appropriate technical and organisational measures, maintaining records of processing activities, adopting privacy by design principles, developing and adhering to internal policies, conducting audits and reviews, and informing CITRA and users of any personal data breaches. Rights of UsersUsers are granted the right to access, review, correct, remove, restrict, object or transfer their personal data, and to withdraw their consent or disable a service at any time. PenaltiesThe Resolution gives CITRA the authority to issue instructions or guidelines related to data privacy whenever necessary, and to apply the penalties and fines stipulated in Law No. 37 of 2014 establishing CITRA as amended by Law No. (98) of 2015 in case of any violation of the Resolution. Concluding RemarksService providers have a grace period of one year from the date of its publication to reconcile their situations with the provisions of the Resolution and other regulations related to it. The Resolution is a significant step towards enhancing the data privacy protection framework in Kuwait and aligning it with the global standards and best practices. It further reflects CITRA's awareness of the need to balance the interests of service providers and users in the rapidly evolving field of communications and information technology, and to foster a culture of trust and compliance among the stakeholders. Moreover, the Resolution contributes to Kuwait's vision of becoming a financial and commercial hub by fostering an environment conducive to attracting investors and promoting innovation in the sector.

For further information,
please contact Lulwa Al Hammad.

^{Published in}^{May 2024}