A technology, media and telecom service that launches across the Gulf and Egypt meets five regulators and five licensing tests: CITRA in Kuwait under Law No. 37 of 2014, the NTRA in Egypt under Law No. 10 of 2003, the TDRA in the UAE under Federal Decree-Law No. 3 of 2003, the CST in Saudi Arabia under the Telecommunications and Information Technology Act (Royal Decree No. M/106), and the CRA in Qatar under Decree-Law No. 34 of 2006. This article sets out what each statute requires, where data and content rules add to the license, and how we review a regional launch before the customer contract is signed.
Classify each function in each market, not the brand
The license question attaches to the activity, not to the label on the pitch deck. Article 16 of Kuwait Law No. 37 of 2014 requires a CITRA license to establish, operate or provide public networks, internet services and international or land telecommunication, and even to advertise them. Article 21 of Egypt Law No. 10 of 2003 prohibits establishing or operating a network, providing a telecommunications service or bypassing international calls without an NTRA license. Article 9 of the Qatari Telecommunications Law reaches resale of services bought from third parties, even for a single beneficiary.
Article 37 of the UAE Decree-Law bars anyone from providing telecommunications services to subscribers through a public network without a license, and Article 5 of the Saudi Act requires a CST license before providing services to the public, offering infrastructure services, or using spectrum or numbering resources. Our standing advice is to break every product into network access, hosting, software, content, payments and support, name the entity that performs each function in each country, and only then ask which statute applies.
Kuwait: the CITRA license and the private network boundary
Under Article 21 of Law No. 37 of 2014, services that rely on scarce state resources, such as frequencies and nationwide fiber, are licensed through public tenders, while other public service licenses are issued on conditions set by the CITRA Board and open to every applicant that meets them. Article 24 provides that the first category is granted by Amiri decree and the second by Board decision under an administrative contract fixing the term, renewal, fees and the proceeds due to CITRA. Under Article 25, interconnection agreements between licensees take effect only with CITRA approval.
The private network rules matter to technology groups. Articles 17 and 18 forbid establishing or operating a private network without a CITRA license, and Article 19 permits interconnection between private networks only through public networks under a written agreement. Article 20 is the hard boundary: whoever owns or operates a private network may not provide public telecommunication services over it. When a corporate network starts serving affiliates, tenants or customers, Article 20 decides whether it is still an internal facility.
Kuwait: devices, user protection, competition, privacy and e-signatures
Articles 43 to 45 require telecommunication devices to meet the technical specifications CITRA sets, bar the supply or sale of non-conforming devices, and require prior CITRA approval to import a device whose specifications have not been announced. On the customer side, Article 47 obliges each public service licensee to keep a complaints section, Article 48 allows tariff changes only after advertisement in two daily newspapers at least seven days ahead and prior notice to CITRA, and Article 53 prohibits cutting a service except for material network damage, unlawful use or unpaid fees after written warning.
Disputes between CITRA and a licensee, or between licensees, go first to the committee added by Law No. 98 of 2015; its decisions bind the parties and court proceedings follow only after it. On privacy, CITRA Decision No. 26 of 2024 issued the Data Privacy Protection Regulation for CITRA licensees. For contract execution, Law No. 20 of 2014 on Electronic Transactions, as amended by Decree-Law No. 148 of 2025, sets in Article 9 the conditions for a valid electronic record and in Article 19 the conditions for a protected electronic signature.
Egypt: NTRA licensing under Law No. 10 of 2003
Article 21 of Law No. 10 of 2003 makes an NTRA license mandatory for establishing or operating a telecommunications network, providing a service, or bypassing international calls. A private network that does not use radio systems needs no license, but the licensed operator hosting it must notify the NTRA. Under Article 22, the application must show technical and financial capability and propose pricing bases, and the NTRA must decide within 90 days of receiving all documents; silence after that period is treated as rejection.
Two further provisions shape commercial deals. Article 28 requires interconnection agreements on reasonable, non-discriminatory terms and submits them to the NTRA for approval, and Article 29 sends interconnection disputes to the NTRA for decision. Article 48 requires NTRA approval of equipment types and permits for importing, manufacturing, using, trading and marketing telecommunications equipment, with a decision due within 90 days of a complete file.
Egypt: personal data, retention duties and content rules
Personal Data Protection Law No. 151 of 2020 requires controllers and processors to obtain a license or permit from the Personal Data Protection Center (Articles 4 and 5), restricts sensitive data without a license (Article 12), and conditions cross-border transfer on an equivalent protection level and a license or permit (Article 14). Article 7 requires notice of a breach to the Center within 72 hours and to the data subject within three working days of that notice. Article 26 adds permits for direct electronic marketing. The Executive Regulations were issued on 1 November 2025, and a transition period runs to 31 October 2026, so a launch planned now falls inside the final weeks of that window.
Article 2 of Anti-Cyber and Information Technology Crimes Law No. 175 of 2018 obliges service providers to retain specified user data for 180 consecutive days; hosting and logging contracts must reflect it. For content, Article 19 of Law No. 180 of 2018 on press and media gives the Supreme Council for Media Regulation blocking powers that reach websites and personal accounts above a follower threshold.
United Arab Emirates: license or exemption under Federal Decree-Law No. 3 of 2003
Article 31 of Federal Decree-Law No. 3 of 2003, as amended, allows a regulated activity only under a license or an exemption granted under the Decree-Law or its executive regulation. Article 37 applies the same rule to services provided to subscribers through a public network, and says the rules on private networks sit in the implementing regulations and Board decisions. Article 35 adds a point that foreign groups often miss: a telecom license does not replace any other permit that another government entity requires before a licensee starts activity.
The penalty is real. Article 71 punishes carrying on a regulated activity without a license or exemption with imprisonment of up to two years and a fine of AED 50,000 to AED 1,000,000, or either penalty.
United Arab Emirates: media content permits and personal data
Federal Decree-Law No. 55 of 2023 on media regulation applies to digital content. Article 12 requires licenses or permits for electronic and digital media activities that provide news or promotion and advertising on social media, and a Media Council permit for a natural person who provides advertising or media content, with or without payment. Article 7 states that a media license does not replace any other permit, and Article 23 allows administrative fines of AED 1,000 to AED 1,000,000, doubled on repetition up to AED 2,000,000, with closure of up to six months and cancellation of the license.
On personal data, Federal Decree-Law No. 45 of 2021 is the onshore statute, and the DIFC and ADGM keep their own regimes. Published 2026 commentary reports that the implementing regulation has not yet been issued, so we advise on the statute and re-check for the regulation before every UAE launch.
Saudi Arabia: the Telecommunications and Information Technology Act
Article 5 of the Act requires a CST license before providing telecommunications services to the public or using a network for that purpose, providing infrastructure services for public networks, using any spectrum or numbering resource, or providing Saudi domain name registration. Article 5(2) lets the Board require a license or registration for specific telecommunications and IT services, expressly including digital content platforms, and for devices and private networks. Article 8 has the Board classify licenses, registrations and permits and set conditions per category, and licensees must comply with them.
Article 7 requires CST approval before a significant change in the ownership of a licensee or registrant or an assignment of its license, and a no-objection statement before a significant change in senior management. A sale or restructuring of a Saudi entity needs CST approval in the timetable. Article 26 treats engaging in a licensed activity before obtaining the license as a violation, and Article 27 allows a fine of up to SAR 25 million, suspension of the service, a ban on obtaining a license for a period and other measures.
Saudi Arabia: cloud registration, personal data and cross-border transfers
CST registers cloud computing service providers under its Cloud Computing Services Provisioning Regulations, and its registration service ties each class of provider to data center certification: Tier 2 or above, or ISO/IEC 27001, for Class A, and Tier 3 or above for Classes B and C, together with the requirements of the Cloud Computing Framework. A provider hosting Saudi workloads should confirm its class before the contract promises hosting location.
The Personal Data Protection Law, issued by Royal Decree No. M/19, restricts a controller from transferring personal data outside the Kingdom except for the purposes and under the conditions listed in Article 29 and its regulations. Article 35 punishes disclosure or publication of sensitive data with intent to harm the data subject or to gain a personal benefit by imprisonment of up to two years and a fine of up to SAR 3 million, or either penalty, and Article 36 allows a warning or a fine of up to SAR 5 million for other violations, which can be doubled for a repeat violation.
Qatar: licenses under Decree-Law No. 34 of 2006 and the data rules
Decree-Law No. 34 of 2006, as amended by Law No. 17 of 2017, which moved the regulatory powers to the CRA, prohibits in Article 9 providing telecommunications services to the public for a fee, owning or operating a network used for that purpose, and owning or operating any other telecommunications network, all without a license. Article 10 creates individual licenses and class licenses. Article 67 punishes violation of Article 9, or of a license condition, by imprisonment of up to one year and a fine of up to QAR 1,000,000, and Article 68 punishes importing, manufacturing, possessing or installing telecommunications equipment without a permit.
Personal Data Privacy Protection Law No. 13 of 2016 forbids a controller from restricting the flow of personal data outside the State unless the processing violates the law or may cause serious damage to the data subject (Article 15), requires prior permission from the competent authority for data of a special nature (Article 16), and requires prior consent for electronic marketing (Article 22).
Align the customer contract with five regimes
The customer agreement must be deliverable under each regime. In Kuwait, Article 53 bars suspension except in the listed cases, so a standard suspension-for-any-breach clause cannot be applied to a licensed telecom service. In Egypt, interconnection terms need NTRA approval under Article 28, so a wholesale price promised to a customer may depend on an approval that has not yet been given. In Saudi Arabia, a change of control clause must reflect the Article 7 approval requirement, and in the UAE a license under Article 35 does not remove other permit duties.
The same applies to data: location, retention and handover clauses must match the Egyptian 180-day duty, the Saudi transfer rules, the UAE onshore and free zone split and the Qatari consent rule. Where a foreign parent, a local partner and a reseller each perform part of the service, the contract should name which entity holds the license, because the regulator looks at the operator of record.
What we review before a regional TMT launch or product change
Our review file holds a function map for each market naming the licensed entity, the license or exemption relied on and its statutory basis; the supplier contracts for network, cloud, content and payments; the data flow map; the customer terms tested against the suspension, retention and approval rules above; and a dated list of open items, including the Egyptian 31 October 2026 date. A new payment module or content library reopens the file.
See also: our MENA data protection analysis and our Kuwait telecom and IT guide, plus our commercial and corporate practice.
Frequently asked questions
Does a software or platform company need a telecom license in the Gulf?
It depends on the function, not the label. A pure software service may need none, but providing services to the public over a network, reselling connectivity or operating a private network that serves third parties can trigger Article 16 in Kuwait, Article 9 in Qatar, Article 5 in Saudi Arabia, Article 37 in the UAE and Article 21 in Egypt.
Can a company serve customers in Qatar through a reseller of another licensed operator?
Article 9 of the Qatari Telecommunications Law reaches resale of services bought from third parties even when the beneficiary is a single person, so a reseller needs its own license or the right class license. Violation carries up to one year of imprisonment and a fine of up to QAR 1,000,000 under Article 67.
How long does an Egyptian telecom license application take?
Article 22 of Law No. 10 of 2003 gives the NTRA 90 days from receipt of all required documents, and an application not decided in that period is treated as rejected.
What is the penalty for operating without a license in the UAE?
Article 71 of Federal Decree-Law No. 3 of 2003 provides imprisonment of up to two years and a fine of AED 50,000 to AED 1,000,000, or either penalty, for carrying on a regulated activity without a license or exemption. Article 35 adds that the license does not replace permits required by other government entities.
Does a Saudi licensee need approval before a share sale?
Yes. Article 7 of the Telecommunications and Information Technology Act requires CST approval before a significant change in ownership of a licensee or registrant, and a no-objection statement for a significant change in senior management. An unapproved change risks the measures in Articles 26 and 27, including fines of up to SAR 25 million.
Can personal data be sent from Egypt to a foreign cloud?
Only on the conditions of Article 14 of Law No. 151 of 2020: an equivalent protection level abroad and a license or permit from the Personal Data Protection Center. The Executive Regulations were issued on 1 November 2025 and the transition period runs to 31 October 2026, so transfer arrangements should be settled now.
Are electronic signatures valid for regional TMT contracts in Kuwait?
Yes, if the signature meets the conditions in Article 19 of Law No. 20 of 2014, as amended by Decree-Law No. 148 of 2025: it identifies the signatory, links uniquely to them, is made with a tool under their exclusive control and shows later alteration. The record must also meet Article 9 on integrity and retrieval.
How do I start a regional TMT legal review with your firm?
Send the function map, the entity chart and the draft customer terms through the contact page of our website. We will confirm the license position for each function in Kuwait, Egypt, the UAE, Saudi Arabia and Qatar, flag the approvals that affect your timetable and propose the contract changes needed before launch.