The framework
Kuwait has no single comprehensive statute and protects personal data through sectoral rules, principally the CITRA Data Privacy Protection Regulation (2021, updated 2024).
For advertisers the consent posture matters most, and Kuwait sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
CITRA Data Privacy Protection Regulation (2021, updated 2024); no standalone statute
Kuwait has no comprehensive law and regulates privacy through a CITRA regulation binding telecom and ICT service providers, though the regulation's reach over apps and platforms makes it broader than it sounds. A full statute remains under discussion.
Marketing and advertising
Consent-oriented duties for telecom and ICT service providers, including apps and platforms, under a regulation that stops short of an economy-wide statute. Most channel decisions here follow from that consent rule.
Cross-border transfers
Regulated providers need CITRA approval for certain transfers abroad.
Enforcement and penalties
CITRA enforces through sanctions attached to its licensing powers.