Kuwait

The Data Privacy Protection Regulation covers a 'Communications and Information Technology Service Provider'. That includes anyone who runs a website, a smart application or cloud computing services. It includes anyone who collects or uses personal data. It also includes anyone who directs another party to collect and use personal data on its behalf. The rules apply whether the work happens inside or outside Kuwait. They catch you if the work is linked to sending advertising or marketing material. They also catch you if you monitor people's behaviour and tendencies. Your record of what you do with data must name you, your data protection officer, and your representative if you sit outside Kuwait. There is no registration threshold and no exemption for small firms. Two things fall outside the rules. Purely personal or family use by an individual. And security authorities working on crime prevention, investigation or prosecution.

Tier three is far broader than most people expect. It covers medical records, court and lawsuit files, legal opinions from law firms, criminal fingerprints and DNA fingerprints. It also covers a company's own meeting minutes, business plans and internal project reports. Tier four covers encryption keys, political and international-relations documents, and military or state-security material. The Cloud Computing Regulatory Framework bans storing or hosting any of it outside Kuwait. Other rules point the same way for particular groups. Private-sector and public-sector cloud users get the same instruction. Do not put tier three or four personal data, or government data, in a provider's data centre outside Kuwait. Public cloud may not be used for tier three at all. You need a private or hybrid cloud, with the tier-three part kept inside Kuwait. Tier two data may go on a public cloud only if it is encrypted and you hold the keys yourself. Industry by industry: HEALTH is closed, because medical records are tier three. LEGAL AND PROFESSIONAL FILES are closed for the same reason. GOVERNMENT is closed for tiers three and four. Defence and security bodies sit outside the tier scheme altogether and set their own rules. BANKING AND PAYMENTS are open with conditions rather than closed. The Central Bank must approve any cloud arrangement touching sensitive data at least one month before you sign. That duty catches branches of foreign banks, even when the group signed the contract abroad. TELECOMS must keep calls and private communications confidential under the law. SECURITIES, INSURANCE, EDUCATION, MAPPING and GAMBLING: we found no separate storage-location rule on the regulators' own sites as at 18 August 2026. The general cloud tiers are what binds them. Gambling is unlawful in Kuwait anyway.

The Data Privacy Protection Regulation gives you one duty here. Tell the person if you intend to send their personal data out of Kuwait. You follow the data classification policy issued by CITRA. The Cloud Computing Regulatory Framework adds that the provider must get consent before content is moved or handled abroad. The Cloud Service Providers rules require written consent that explains the reasons and names the recipient. So Kuwait does not keep a list of approved countries, and it does not keep a list of banned ones. There is no list to fill, and no country is assessed. Two other conditions matter. First, the receiving cloud provider must be registered or licensed by the regulator before any content moves to a public, hybrid or community cloud. Second, licensed providers must tell the regulator where their data centres sit inside Kuwait. They must also name every country where they run data centres that touch Kuwaiti subscribers' content.

CITRA is staffed and working as a telecoms regulator. Its register of regulatory decisions lists 73 decisions. The most recent is dated 8 June 2026. Its public consultation register shows consultations closing in April and June 2026. So this is not an empty chair. The privacy side looks unused. Cloud service provider licensing does not appear anywhere in CITRA's published list of licensing services. Its cybersecurity pages still lead with a national strategy covering 2017 to 2020, and with controls written for the coronavirus period. A revised privacy regulation went out to public consultation on 10 August 2023. Three years later, the version on CITRA's own site is still v1.8. No decision in the public register concerns personal data. The Central Bank of Kuwait is different. It publishes a running list of penalties, with actions against local banks, exchange companies and electronic payment providers dated October and November 2025. It released a 389-page Cyber and Operational Resilience Framework on 3 December 2025. The Capital Markets Authority and the Insurance Regulatory Unit are also visibly active. The Insurance Regulatory Unit published decisions and news through May 2026. Neither of them sets a rule about where data must sit. So if you are a bank, you face a real regulator. If you are anyone else, the privacy rules depend on your own discipline.

The ceiling. The Data Privacy Protection Regulation tells you to destroy personal data you hold once your contract with the person ends. You must also destroy it during the contract if the person asks. You must delete the data if the person withdraws consent. The same applies if you no longer need it for the service, or if the person stops using the service. When someone withdraws consent, you must wipe the data from hardware and from logs, and keep no copies. The floors. Payment, electronic money and payment infrastructure firms supervised by the Central Bank have a ten-year rule. They must keep all electronic documents, records and data for at least ten years from the end of the contract. Anti-money-laundering paperwork must be kept for at least five years from the end of the customer relationship. Investment and securities firms licensed by the Capital Markets Authority keep complaint records for five years. They keep business-continuity records for five years from when those records stop being used. How the clash resolves. Nothing in the privacy rules says the keeping periods beat the deletion duty. Nothing in the financial rules says the opposite. The financial rules are the safer master, because a supervisor stands behind them and issues fines. This is a real gap, not a simplification.

Clock one: 24 hours. This applies where personal data held by a licensee is wrongly disclosed, or accessed by a third party. The disclosure must also harm a large number of users. Notice must go to CITRA, to end users and to law enforcement as soon as possible. The deadline is 24 hours from the point where the licensee reasonably concludes there has been a breach. It runs to three recipients at once, including the police, which is unusual. Clock two: 72 hours to CITRA for any personal data breach. The report has a set content list. It covers the nature of the breach, how much data leaked, who was affected and the security levels breached. It also covers how to reach the data protection officer, the likely consequences and the remedy taken. Clock three: 72 hours to the affected person. You can skip this if strong technical protections were already applied to the affected data and your follow-up steps have removed the risk. Clock four, for financial firms only. High-severity incidents go to the Central Bank within one hour of discovery, with progress updates every four hours. Medium severity goes within four hours, with daily updates. Low severity is bundled up monthly. The overlap is the trap. One breach at a Kuwaiti bank's cloud-hosted customer platform can start four clocks. The one-hour bank clock, the 24-hour large-scale clock, the 72-hour regulator clock and the 72-hour individual clock. All of them run from the same moment of discovery.

One. The Data Privacy Protection Regulation requires the 'explicit consent of the guardian of a child whose age is less than 18 years'. You must make reasonable efforts, using the technology available, to check age. There is no lower age for digital consent as there is in Europe. The regulator says it will set the method for getting the guardian's consent. It has not published one. Two. Tier three of the Data Classification Policy is not limited to personal data. It lists 'Minutes of meeting and business plans' and 'Internal project reports' alongside medical records and DNA fingerprints. Tier three may not be hosted outside Kuwait for any purpose. So a routine group intranet, or an overseas project management tool, can break the rule. Three. A cloud provider that wants to host tier three or four data must be licensed by CITRA. It must prove it owns a licensed data centre inside Kuwait. It must renew every year. It may not provide services before the licence is issued. Contracts signed by an unlicensed provider are stated to be void. Four. The privacy rules require internal systems that receive and handle access, correction and deletion requests 'around the clock'. Your data protection officer must be available 24 hours a day. Five. The 24-hour large-breach notice goes to law enforcement, not only to the regulator. That changes how you handle an incident from the first minute. A sixth point for completeness. The cloud rules cover providers who are subject to a foreign country's court laws. They must not hand a subscriber's content to any government or public authority, Kuwaiti or foreign. That sits awkwardly with disclosure orders from abroad.

Unused powers matter more here than pending law, and Kuwait has four. First, the Cloud Computing Regulatory Framework says CITRA may amend its chapters and articles 'without prior notice'. So the rules on where data must sit can change overnight, with no consultation at all. Second, the same document lets CITRA make accreditation plans and standards mandatory by decision. Third, the classification policy invites the regulator to issue a Data Classification and Handling Procedure Guide. That would change what falls into the tiers that may not leave the country. Fourth, the revised privacy regulation consulted on in August 2023 has never been published. The current version can be replaced without further notice. On the financial side, the Central Bank's Cyber and Operational Resilience Framework version 1.0 was released on 3 December 2025. It replaces the 2020 Cybersecurity Framework. We found no published compliance deadline for it, so treat it as binding now. One piece of background. Kuwait's National Assembly was dissolved in 2024, and law is being made by decree. That means a general data protection law could appear with no parliamentary process. We could not confirm this on a Kuwaiti government site, so treat it as background rather than fact.