Data Protection Rights

Source: Law No. 20 of 2014 (Electronic Transactions); Constitution of Kuwait, Article 39; Various sector-specific regulations

Written in plain language for general understanding. This is educational content, not legal advice. Based on Kuwaiti national legislation, Amiri decrees, and ministerial decisions.

Kuwaiti National Law

What is this right?

Kuwait does not yet have a comprehensive standalone data protection law, but several laws provide privacy protections:

  • The Constitution (Article 39) guarantees the privacy of communication — interception without a court order is illegal.
  • The Electronic Transactions Law requires businesses to protect personal data collected online.
  • Banks and financial institutions must protect customer data under Central Bank of Kuwait (CBK) regulations.
  • Telecom providers must protect subscriber data under the Communications and Information Technology Regulatory Authority (CITRA) rules.
  • Sharing someone's personal information without consent can result in criminal penalties under the Penal Code and the Cybercrime Law (Law No. 63 of 2015).

When does it apply?

  • A company shared or leaked your personal data without your consent.
  • You are receiving unsolicited marketing messages from a company you did not give permission to contact you.
  • Your online accounts were breached due to a company's failure to protect your information.

What should you do?

  • Contact the company directly and demand they stop using or sharing your data.
  • For telecom-related privacy issues, complain to CITRA.
  • For bank data breaches, report to the Central Bank of Kuwait.
  • For online privacy violations, file a complaint under the Cybercrime Law at the nearest police station or the Cybercrime Department.

What should you NOT do?

  • Do not share personal data online unnecessarily — only provide what is required for the transaction.
  • Do not ignore data breach notifications — change your passwords and monitor your accounts immediately.
  • Do not retaliate by exposing someone else's data — this is also a crime under the Cybercrime Law.

You came here to know your rights — help someone else know theirs.

Support This Mission