To date, Kuwait does not have a dedicated personal data protection law applying to all juristic or natural personsw. However, legislation such as Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”), includes provisions related to data privacy and data protection of private and public electronic records, documents, and information related to civil, commercial, or administrative transactions conducted in whole or in part through electronic means and applies to private companies, government authorities, public institutions, and non-governmental organizations, and their employees. Furthermore, Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”) imposed heavy penalties for illegal tampering with or acquisition of personal or governmental data or information.

Additionally, Kuwait Administrative Decision No. 26 of 2024 Concerning the Issuance of the Data Privacy Protection Regulation (“Data Protection Regulation”) by the Communications and Telecommunications Regulatory Authority (“CITRA”), imposes obligations in relation to data protection on Telecommunication Services Providers and related industry sectors who collect, process, or store personal data, in whole or in part. The Data Protection Regulation applies exclusively to individuals and entities operating as service providers within the telecommunications sector and holding licenses issued by CITRA, and describes the conditions for collecting and possessing personal data and the obligation of a service provider during the provision of the service or after the end thereof, in relation to the collection and processing of such data. The Data Protection Regulation provides a wider ambit of the definition of “service provider” which ranges from traditional telecommunications service providers to anyone who operates a website, smart application or cloud computing service, collects or processes personal data or directs another party to do so on its behalf through information centers owned or used by them directly or indirectly. Furthermore, the Data Protection Regulation indicates that users have a right to withdraw their consent and, consequently, the service provider must delete / destroy the information provided by the user. However, the provisions of the Data Protection Regulation do not apply to natural persons who collect and process personal and family data; or security authorities for the purposes of controlling crimes and the prevention of threats related to public security.