Find a Lawyer
Book an appointment with us, or search the directory to find the right lawyer for you directly through the app.
Find out more
Level Up: Unlocking Financial Potential In The Middle East
Welcome to this edition of Law Update, where we focus on the ever-evolving landscape of financial services regulation across the region. As the financial markets in the region continue to grow and diversify, this issue provides timely insights into the key regulatory developments shaping banking, investment, insolvency, and emerging technologies.
2025 is set to be a game-changer for the MENA region, with legal and regulatory shifts from 2024 continuing to reshape its economic landscape. Saudi Arabia, the UAE, Egypt, Iraq, Qatar, and Bahrain are all implementing groundbreaking reforms in sustainable financing, investment laws, labor regulations, and dispute resolution. As the region positions itself for deeper global integration, businesses must adapt to a rapidly evolving legal environment.
Our Eyes on 2025 publication provides essential insights and practical guidance on the key legal updates shaping the year ahead—equipping you with the knowledge to stay ahead in this dynamic market.
A complete spectrum of legal services across jurisdictions in the Middle East & North Africa.
Kuwait Data Privacy Protection Regulations
The Communication and Information Technology Regulatory Authority (“CITRA”) of Kuwait has recently issued a new resolution No. 26 of 2024 concerning the issuance of data privacy protection regulations (“Resolution”).
Introduction
The Resolution, which was published in the Official Gazette on February 18, 2024, aims to regulate the data management and processing practices of service providers licensed by CITRA who operate in the field of collecting, processing and storing personal data and the content of user data. The Resolution also seeks to protect the fundamental rights and freedoms of users related to the privacy of their personal data, and to support the development of a strong and competitive industry of communications and information technology services in Kuwait.
Who does it apply to?
The Resolution applies to all service providers who provide communications and information technology services to the public, whether the processing is carried out inside or outside Kuwait.
Main definitions
A “service provider” is defined as a person licensed to provide a service or more of telecommunication services to the public; or licensed to manage, establish or operate a telecommunication network or internet service to provide communication service to the public which includes information or content providers provided through telecommunication network.
Further, “personal data” is defined as data related to identified natural or legal person or may be identified based on this data directly, such as identifying the name and identity, financial, health, ethnic, or religious data, or any data that allows to
Obligations on the Service Provider
According to the Resolution, service providers must obtain the consent of the user for the collection or processing of personal data and inform them of the purpose, terms and conditions of the service and data change or cancellation request. The Resolution also specifies the cases in which data collection and processing are lawful and legal, such as complying with a legal obligation, protecting the user data, or identifying the data holder.
Further, a requirement is placed on the service providers to collect and process data in a transparent, secure and appropriate manner, and to provide clear and accessible information on their personal data practices and policies.
The Resolution also imposes several obligations on service providers to ensure the security and protection of personal data, such as taking appropriate technical and organisational measures, maintaining records of processing activities, adopting privacy by design principles, developing and adhering to internal policies, conducting audits and reviews, and informing CITRA and users of any personal data breaches.
Rights of Users
Users are granted the right to access, review, correct, remove, restrict, object or transfer their personal data, and to withdraw their consent or disable a service at any time.
Penalties
The Resolution gives CITRA the authority to issue instructions or guidelines related to data privacy whenever necessary, and to apply the penalties and fines stipulated in Law No. 37 of 2014 establishing CITRA as amended by Law No. (98) of 2015 in case of any violation of the Resolution.
Concluding Remarks
Service providers have a grace period of one year from the date of its publication to reconcile their situations with the provisions of the Resolution and other regulations related to it.
The Resolution is a significant step towards enhancing the data privacy protection framework in Kuwait and aligning it with the global standards and best practices. It further reflects CITRA’s awareness of the need to balance the interests of service providers and users in the rapidly evolving field of communications and information technology, and to foster a culture of trust and compliance among the stakeholders.
Moreover, the Resolution contributes to Kuwait’s vision of becoming a financial and commercial hub by fostering an environment conducive to attracting investors and promoting innovation in the sector.
Key Contacts
l.alhammad@tamimi.comSpread the news
Stay updated
To learn more about our services and get the latest legal insights from across the Middle East and North Africa region, click on the link below.
