Kuwait

The Data Privacy Protection Regulation defines a 'Communications and Information Technology Service Provider' to include a person who 'operates a website, smart application or cloud computing services, collects or processes personal data or directs another party that collects and processes personal data on its behalf'. Article 1 extends the regulation to processing 'whether processed inside or outside the State of Kuwait' where it is linked to sending advertising or marketing material, or to monitoring the behaviour and tendencies of the people concerned. Article 7 requires the record of processing activities to name 'the service provider and its representative if it is outside Kuwait and the data protection officer'. There is no registration threshold and no exemption for small firms. Two carve-outs exist: purely personal or family use by an individual, and security authorities acting for crime prevention, investigation or prosecution.

Tier three is far broader than most people expect. It captures medical records, court and lawsuit files, legal opinions from law firms, criminal fingerprints and DNA fingerprints, and also a company's own meeting minutes, business plans and internal project reports. Tier four covers encryption keys, political and international-relations documents, and military or state-security material. The Cloud Computing Regulatory Framework forbids storing or hosting any of it outside Kuwait. Separate rules point the same way for specific groups: private-sector and public-sector cloud users are both told not to place tier three or four personal data, or government data, on a provider's data centre outside Kuwait; public cloud may not be used for tier three at all, only private or hybrid cloud with the tier-three part kept inside Kuwait; and tier two data may go on a public cloud only if it is encrypted with keys held solely by the customer. Sector by sector: HEALTH is effectively closed, because medical records are tier three. LEGAL AND PROFESSIONAL FILES are closed for the same reason. GOVERNMENT is closed for tier three and four, and defence and security bodies are exempt from the classification scheme altogether and set their own rules. BANKING AND PAYMENTS are conditional rather than closed, but the Central Bank must approve any cloud arrangement touching sensitive data at least one month before signing, and that duty catches branches of foreign banks even when the contract was signed by the group abroad. TELECOMS carry a statutory confidentiality duty over calls and private communications. SECURITIES, INSURANCE, EDUCATION, MAPPING and GAMBLING: no separate storage-location rule was found on the regulators' own sites as at 18 August 2026, so the general cloud tiers are what binds them. Gambling is in any event unlawful in Kuwait.

The Data Privacy Protection Regulation requires the provider to 'Notify the data owner in case the service provider intends to transfer his personal data out of Kuwait in accordance with the data classification policy issued by CITRA'. The Cloud Computing Regulatory Framework adds a prior-consent duty on the provider before content is moved or processed abroad, and the Cloud Service Providers rules require written consent explaining the reasons and naming the recipient. Kuwait therefore does not operate an allowlist or a blocklist of destination countries: there is no list to be populated, and no country-level assessment is made. Two other conditions bite in practice. First, the receiving cloud provider must be registered or licensed by the regulator before any content moves to a public, hybrid or community cloud. Second, licensed providers must disclose to the regulator both their data-centre locations inside Kuwait and every country where they run data centres that touch Kuwaiti subscribers' content.

Evidence that CITRA is genuinely staffed and working: its regulatory-decisions register lists 73 decisions with the most recent dated 8 June 2026, and its public-consultation register shows consultations closing in April and June 2026. So this is not an empty chair. Evidence that the privacy layer is dormant: cloud service provider licensing does not appear anywhere in CITRA's published list of licensing services; its cybersecurity pages still headline a national strategy covering 2017 to 2020 and controls written for the coronavirus period; a revised privacy regulation went out to public consultation on 10 August 2023 and, three years later, the version published on CITRA's own site is still v1.8; and no decision in the public register concerns personal data. By contrast the Central Bank of Kuwait publishes a running list of penalties, with actions against local banks, exchange companies and electronic payment providers dated October and November 2025, and it released a 389-page Cyber and Operational Resilience Framework on 3 December 2025. The Capital Markets Authority and the Insurance Regulatory Unit are also visibly active, the latter publishing decisions and news through May 2026, but neither imposes a data-location rule of its own. Reading the whole picture: if you are a bank you face a real regulator; if you are anyone else, the privacy rules currently depend on your own discipline.

Ceiling. The Data Privacy Protection Regulation requires the provider to 'Destroy personal data in its possession once the contractual relationship with the data owner has expired, or during the contract term if the data owner so requests', and separately to delete the data where consent is withdrawn, where the data is no longer needed for the service, or where the person is no longer using the service. Withdrawal of consent triggers a duty to destroy the data from hardware and from logs, and to keep no duplicates. Floors. Payment, electronic money and payment infrastructure firms supervised by the Central Bank must keep all electronic documents, records and data for not less than ten years from the end of the contractual relationship. Anti-money-laundering documentation must be kept for at least five years from the end of the customer relationship. Investment and securities firms licensed by the Capital Markets Authority keep complaint records five years, and business-continuity records five years from when they stop being used. How the clash resolves. Nothing in the privacy regulation says the retention floors override the deletion duty, and nothing in the financial rules says the reverse. In practice the specific financial obligations are the safer master, because they carry a supervisor who fines. This is a genuine gap, not a simplification.

Clock one: 24 hours. Where personal data held by a licensee is wrongly disclosed or accessed by a third party and the disclosure harms a large number of users, notice must go to CITRA, to end users and to law enforcement agencies as soon as possible and within 24 hours of the licensee reasonably concluding there has been a breach. Note that it runs to three recipients at once, including the police, which is unusual. Clock two: 72 hours to CITRA for any personal data breach, with a prescribed content list covering the nature of the breach, how much data leaked, who was affected, the security levels breached, the data protection officer's contact route, likely consequences and the remedy taken. Clock three: 72 hours to the affected individual, unless strong technical protections were already applied to the affected data and follow-up steps have removed the risk. Clock four, for financial firms only: high-severity incidents to the Central Bank within one hour of discovery with progress updates every four hours, medium severity within four hours with daily updates, and low severity consolidated monthly. Overlap is the trap. A single breach at a Kuwaiti bank's cloud-hosted customer platform can trigger the one-hour bank clock, the 24-hour large-scale clock, the 72-hour regulator clock and the 72-hour individual clock, all from the same moment of discovery.

One. The Data Privacy Protection Regulation requires 'explicit consent of the guardian of a child whose age is less than 18 years', with reasonable efforts and available technology used to verify age. There is no lower digital-consent age as in Europe, and the regulator says it will set the mechanism for obtaining the guardian's consent, which it has not published. Two. Tier three of the Data Classification Policy is not limited to personal data. It expressly lists 'Minutes of meeting and business plans' and 'Internal project reports' alongside medical records and DNA fingerprints. Since tier three may not be hosted outside Kuwait for any purpose, a routine group intranet or an overseas project management tool can breach the rule. Three. A cloud provider wanting to host tier three or four data must be licensed by CITRA, must prove it owns a licensed data centre located inside Kuwait, must renew annually, and is prohibited from providing services before the licence issues. Contracts signed by an unlicensed provider are stated to be void. Four. The privacy regulation demands internal systems to receive and handle access, correction and deletion requests 'around the clock', and 24-hour availability of the data protection officer. Five. The 24-hour large-breach notice goes to law enforcement agencies, not only to the regulator, which changes how an incident should be handled from the first minute. A sixth point for completeness: the cloud framework tells providers that where they are subject to a foreign country's judicial laws, they must not hand a subscriber's content to any domestic or foreign government or public authority, which sits awkwardly with overseas disclosure orders.

Dormant switches matter more here than pending law, and Kuwait has four of them. First, the cloud framework states outright that CITRA may amend its chapters and articles 'without prior notice', so the residency rules can change overnight with no consultation at all. Second, the same framework lets CITRA declare accreditation plans and standards mandatory by decision. Third, the classification policy invites the regulator to issue a Data Classification and Handling Procedure Guide, which would change what falls into the untransferable tiers. Fourth, the revised privacy regulation consulted on in August 2023 has never been published, so the current version can be replaced without further notice. On the financial side the Central Bank's Cyber and Operational Resilience Framework version 1.0 was released on 3 December 2025 and replaces the 2020 Cybersecurity Framework; we could not find a published compliance deadline for it, so treat it as already binding. One piece of constitutional context: Kuwait's National Assembly was dissolved in 2024 and legislation is being made by decree, which means a general data protection statute could appear without any parliamentary process. We could not verify that point on a Kuwaiti government site from our network, so treat it as background rather than fact.