Law note · Kuwait
CITRA Data Privacy Protection Regulation
What it requires
- An app that is a CITRA-licensed telecommunications or information-technology service provider in Kuwait must, per secondary legal-commentary sources not yet confirmed at primary source, obtain a customer's explicit consent (or a guardian's, for a minor under 18) before collecting or processing personal data, a duty this document treats as reaching a voiceprint or faceprint like any other identifying data since the reported consent requirement carries no category-specific qualification; this is an inference from secondary commentary, not an independently confirmed reading of the regulation's own biometric-data treatment. Kuwait has no general cross-sector personal-data statute, so an app outside CITRA's licensed scope is not currently bound by a dedicated privacy law of this kind.
When LexLint raises it
crawls_webprocesses_biometricsprocesses_voice
What we found
Kuwait has no cross-sector data-protection statute. This regulation, issued by CITRA, applies only to CITRA-licensed telecommunications and information-technology service providers.
Per secondary sources, it requires explicit consent before collecting or processing personal data, with no category-specific qualification, a legal-guardian consent requirement for minors under 18, requires breach notification to CITRA reportedly within 72 hours, and requires appropriate technical and organizational security measures.
A DataGuidance-sourced commentary states that biometric data is "Not applicable" under Kuwait's current framework; read alongside the general, unqualified consent duty, the more likely reading is the same pattern found in Qatar and Bahrain in this batch, no distinct heightened category for biometric data, rather than biometric data falling outside the regulation's personal-data coverage altogether, but neither reading was confirmed against the regulation's own primary text in this research pass: every attempt to fetch it returned a PDF.js viewer shell rather than extracted text, and no working alternate primary-source mirror was found.
No effective date is recorded here because no primary source confirming one was read; secondary trackers report 19 February 2024.
Primary source
secondary legal-commentary trackers (Michalsons, Al Tamimi, DataGuidance/glaco.com, Securiti, Chambers)
the regulation's own primary text could not be read in this research pass