Kuwait has no dedicated artificial intelligence statute and no single state-wide data protection law. A company that deploys AI in Kuwait, or a lawyer who uses it, is governed by several instruments that were written for other purposes. The most relevant are Electronic Transactions Law No. 20 of 2014, the Data Privacy Protection Regulation adopted by the Communication and Information Technology Regulatory Authority (CITRA) in Decision No. 26 of 2024, and the sector rules for health and telecommunications. At Hind Bin Al Sheikh & Partners we start every AI engagement by identifying which of these actually applies to the client.
No AI statute, and no single data protection law
Our first advice is to be exact about what exists. Kuwait has not enacted a comprehensive AI law, and its privacy rules are spread across the Electronic Transactions Law, the CITRA regulation, cybercrime provisions and sector rules. We do not tell clients that a general data protection law applies, because none does, and we do not rely on drafts or policy announcements as if they were enacted.
This shapes the work. A client cannot answer a compliance question by naming one statute. We have to identify the sector, the kind of data and the regulator, and then apply the instrument that actually reaches the facts. Where no instrument reaches a point, we say so plainly and propose a contract term instead of inventing a rule. The result is often a mix of statutory duties and contractual protections that the parties must build themselves.
Electronic Transactions Law No. 20 of 2014 as the general baseline
Electronic Transactions Law No. 20 of 2014 and its executive regulations, Decision No. 48 of 2014, are the closest thing Kuwait has to a general baseline for personal data held in electronic records. Article 4 requires consent before a person is made to deal electronically, and Articles 32 and 35 require consent for access, disclosure, sharing and processing of collected data, limited to the purpose stated to the data subject.
Article 33 gives a person the right to request access to the data held about them, Article 35 requires the entity to verify accuracy and protect the data, and Article 36 gives the right to modify or delete. An AI tool that processes customer or employee records in Kuwait should be assessed against these articles first, since they apply to companies and authorities and do not depend on a license.
CITRA Decision No. 26 of 2024 and who it covers
Decision No. 26 of 2024 was issued on 7 February 2024 and published in the Official Gazette (Kuwait Al-Youm) on 18 February 2024. It adopts the Data Privacy Protection Regulation approved by the CITRA board on 5 December 2023, repeals the earlier Decision No. 42 of 2021, and takes effect from its publication on 18 February 2024. Under Article 1 of the regulation, it applies to service providers that collect, process and store personal data, and current practitioner sources describe its scope as limited to CITRA licensees such as telecommunications and internet providers.
The consequence is that a bank, a retailer or a clinic using AI is not bound by this regulation merely because it uses data. A licensed telecom or internet provider that uses AI on subscriber data is bound. We confirm license status first, because getting this question wrong sends a client to the wrong rulebook and the wrong regulator. License status is a matter of fact that can be checked with the client's own documents, and we ask for them at the first meeting.
Consent, purpose and transparency under the CITRA regulation
For licensees, Articles 2 and 4 of the regulation require the provider to obtain the user's consent before collecting and processing personal data and to state the purpose, the legal basis, the retention period and the provider's identity and contact details. Terms must be given in clear language in Arabic and English. A licensee that wants to use subscriber data to train or tune an AI model must declare that purpose to the user.
Article 4 also requires accessible means for the user to access, correct and withdraw, and to have data deleted when the relationship ends. We advise licensees to test their AI use case against each of these duties and to keep a record of the consent text, date and version shown to the user, because the provider carries the burden of proving consent.
Regulators and who enforces what
Kuwait has no single authority with overarching power over data protection. CITRA, established by Law No. 37 of 2014, regulates its licensees and can inspect records, require corrective measures and refer suspected offenses to the competent authorities. The Central Agency for Information Technology stands behind the Electronic Transactions Law and its executive regulations, and the National Centre for Cybersecurity, established by Decree No. 37 of 2022, has the central cybersecurity role, particularly for government entities.
For a client this means one AI incident can involve more than one body. A telecom licensee may answer to CITRA, a company with electronic records to the general rules of Law No. 20 of 2014, and a government supplier to cybersecurity requirements. We map the likely regulators at the start so that the incident plan names the right contacts and sequence.
Security, breach notice and transfers abroad for licensees
Article 5 of the regulation requires licensees to protect personal data against unauthorized access, loss, destruction and damage, with measures such as encryption and recovery planning. Article 6(1) requires the licensee to notify CITRA of a personal data breach within 24 hours after it learns of it, and to tell the affected data subject unless suitable technical and organizational protection measures were applied to the affected data. Separately, Article 4(15) requires the licensee to notify CITRA, the users and law enforcement as soon as possible, and within 72 hours at most, where stored personal data is improperly disclosed and many users are harmed. We advise clients to plan for the 24-hour notice to CITRA.
Under Article 4, a licensee must tell users when their data will be transferred outside Kuwait and must say where data is stored. Many AI services run on foreign cloud platforms, so a transfer is often built into the product. We ask the vendor to confirm every storage location and sub-processor in writing before a licensee goes live.
Retention, deletion and the end of an AI project
AI projects create copies of data that nobody planned for: training sets, prompt logs, test exports and vendor backups. Article 36 of Law No. 20 of 2014 gives the data subject a right to modify or delete, and Article 4 of the CITRA regulation requires a licensee to delete personal data when the user withdraws consent or the relationship ends. A deletion duty that stops at the production database is not a real deletion duty.
Our standing advice is to list every copy at the start, to give the vendor a written deletion duty with a certificate at exit, and to fix a retention period for prompt logs. When a client asks us to close a project, we check that these copies are gone and that the record of deletion is kept with the decision file.
Sector rules that reach AI: health, cloud and cybercrime
Health data has its own rule. The Medical Profession Law No. 70 of 2020 requires healthcare providers to keep patient records securely, and written patient consent is generally needed to disclose medical data. An AI tool that reads clinical notes or imaging must be reviewed against that duty before it receives a single record, and de-identification does not replace the need to ask.
Cloud service providers are subject to CITRA's cloud framework, which describes the information a provider may collect and the duty to tell users what is collected automatically. The cybercrime provisions criminalize unlawful access to, alteration of and disclosure of data. We do not treat these as AI rules, but they set the outer boundary of what a deployment may do with other people's information.
Contracts with AI vendors in Kuwait
With no AI statute, the vendor contract carries most of the protection. We read it for five points: who is the data holder, whether the vendor may train on client data, where the data is stored, who bears liability for wrong output, and what happens to the data when the contract ends. Where the client is a CITRA licensee, the regulation's duties must be passed down to the vendor in writing.
Our standing advice is to avoid broad licenses that let a vendor reuse client data for its own products. We also recommend an audit right, a breach-notice duty that is shorter than the client's own legal deadline, and a deletion certificate at exit. These clauses are ordinary commercial terms, and a vendor that refuses all of them tells the client something useful. We also ask for a list of sub-processors and for notice before any change to them.
Accountability for AI output and decisions
Kuwait has no rule that treats an AI system as a legal actor. The company or professional that relies on a model answers for what it does with the result, under general contract and civil liability principles and under the sector rules above. A wrong credit decision, a mistaken diagnosis or an inaccurate legal draft is the responsibility of the person who used it.
We advise clients to keep a decision record for each material AI use: what the system was asked, what it returned, who reviewed it and what was decided. A short file of this kind is the best evidence that a human exercised judgment, and in a dispute it is often more useful than the model's own logs. The record should be kept by the business owner of the decision and not only by the technical team.
Lawyers, AI and professional confidentiality
The Advocacy Law No. 42 of 1964 regulates the legal profession before the courts, and a lawyer's duty of professional secrecy is a core part of it. That duty does not pause when a lawyer pastes a client document into a public AI tool. Lawyers must treat client facts as protected and must not place them in a service that retains or reuses what it receives.
When we use AI in our own work, we treat the tool as a third party. No client facts go into a service that retains or trains on them without a written agreement, and a lawyer remains responsible for checking every citation and draft. We advise in-house legal teams and other firms in Kuwait to adopt the same rule and to write it into their staff policy.
What we review in an AI deployment in Kuwait
When we review an AI deployment in Kuwait, we first identify the sector and the regulator, then check license status against Decision No. 26 of 2024. We read the consent and notice against Articles 4, 32 and 35 of the Electronic Transactions Law, review the vendor contract and the data location, check any health or telecom rule, and record the result in a short decision file for the client.
See also: our Kuwait data protection guide and our Kuwait intellectual property guide, plus our commercial and corporate practice.
Frequently asked questions
Is there an AI law in Kuwait?
No. There is no dedicated AI statute, and we do not treat policy announcements or drafts as law. The binding rules come from existing instruments such as Law No. 20 of 2014, sector laws and the contract.
Does Kuwait have a general data protection law?
No. The Electronic Transactions Law No. 20 of 2014 is the general baseline for electronic records, and the CITRA regulation under Decision No. 26 of 2024 covers licensees.
Does the CITRA regulation apply to my company?
Only if you hold a CITRA license, such as a telecom or internet service provider. Check your license before you rely on the regulation or ignore it.
Do I need consent to put customer data into an AI tool?
Yes, as a rule. Articles 32 and 35 of Law No. 20 of 2014 require consent for processing and limit use to the stated purpose, and a licensee faces the same requirement under Articles 2 and 4 of the CITRA regulation.
Can medical records be used with AI?
Only within Medical Profession Law No. 70 of 2020, which requires secure records and, in general, written patient consent for disclosure. Obtain that consent before the data reaches the tool.
Who is liable if the AI gets it wrong?
The company or professional that relied on it. Kuwaiti law does not treat the system as an actor, so allocate vendor liability in the contract.
May a lawyer use a public AI tool for client files?
Not for confidential material. Professional secrecy under the Advocacy Law No. 42 of 1964 applies to the lawyer, and a public tool is an uncontrolled third party.
Can Hind Bin Al Sheikh & Partners review our AI contracts and data flows?
Yes. Use the contact page and tell us the sector, the systems and the vendors involved, and we will confirm the scope and next steps.