Personal Data Protection Law No. 26/2024 (CITRA)

Kuwait's Personal Data Protection Law No. 26 of 2024, enacted in February 2024, is the country's first dedicated legislation for personal data protection. It establishes rules for lawful data processing, individual rights, and organizational responsibilities under the supervision of the Communication and Information Technology Regulatory Authority (CITRA).The law applies to banks, telecom operators, government entities, e-commerce platforms, healthcare providers, and other public and private organizations in Kuwait that collect or process personal data. It introduces requirements around consent, data minimization, cross-border transfer restrictions, and regulatory oversight.