My company works in Kuwait. What does the law ask of us when an AI agent reads our data?
The short answer
I found no comprehensive personal data protection law in force in Kuwait as of October 2026. The Data Privacy Protection Regulation of the telecoms regulator, CITRA, applies to service providers that CITRA licenses, and its definition of a service provider also covers providers of information or content delivered over the telecom network. For other companies, the privacy chapter of the Electronic Transactions Law applies to personal data held in electronic systems. It requires consent, limits use to the stated purpose, and requires security. I found no Kuwaiti law on AI itself.
The law that applies
I found no comprehensive personal data protection law in force in Kuwait as of October 2026. I also found no official publication of a draft general law. Two texts matter for an AI agent, and which one binds you depends on who you are.
The first is the Data Privacy Protection Regulation of the Communication and Information Technology Regulatory Authority, CITRA. CITRA issued it by Decision 26 of 2024 on 7 February 2024, and it replaced the earlier regulation of 2021. It applies to all service providers licensed by CITRA that collect, process or store personal data, whether the processing takes place inside or outside Kuwait. The regulation defines a service provider as a person licensed to provide telecom services to the public, or to run a telecom network or internet service for the public. The definition includes providers of information or content delivered over the telecom network. So check whether your company falls within this definition.
The second is Law 20 of 2014 on Electronic Transactions. Its chapter on privacy and data protection applies to government bodies, public bodies and institutions, companies and non-government entities, and to the people who work in them. It covers personal data recorded in electronic processing systems. This is the text that binds an ordinary company whose agent reads its records.
Can the agent read personal data at all?
Under the Electronic Transactions Law:
- No access or disclosure without right. Outside the cases the law permits, personal data recorded in electronic processing systems, such as employment matters, health or financial position, may not be accessed, disclosed or published without right. It is allowed only with the consent of the person or their legal representative, or by a reasoned court decision.
- One purpose. You must state the purpose of collecting the data, and collect only within that purpose. You may not collect data by unlawful means or without the person’s consent, and you may not use it for a purpose other than the one it was collected for.
- Accuracy and security. You must check the data is accurate, update it regularly, and protect it from loss, damage, disclosure or modification.
If your company is a CITRA licensee, the regulation adds its own rules. Processing is lawful only in one of the listed cases: the user’s consent, a legal obligation, protecting the user’s data, or purposes that require identifying the user. Data of a minor under 18 needs written consent from the guardian. In every case you must be able to prove the user’s consent.
The model provider, and data sent abroad
The privacy chapter of the Electronic Transactions Law has no specific rule on sending data abroad. Its consent, purpose and security rules still apply to what the agent sends to a model provider.
For a CITRA licensee, the regulation calls anyone who processes personal data on the provider’s behalf and under its direction a third party. A model provider fits that description. The licensee must:
- tell CITRA when it discloses users’ data to a sister company, an owning company or a third party, and it stays responsible for protecting that data.
- tell users where their data is stored, inside or outside Kuwait.
- tell the user when it intends to transfer their data outside Kuwait.
- record each transfer outside Kuwait and name the destination country.
When something goes wrong
A CITRA licensee must notify CITRA within 24 hours of learning of a personal data breach, and must tell the affected person. It need not tell the person if it had applied suitable technical and organizational protection to the affected data. Where stored personal data is wrongly disclosed and this harms a large number of users, the licensee must notify CITRA, the users and law enforcement as soon as possible, and within 72 hours at most. If a violation is proven, CITRA may apply the penalties of its own Law 37 of 2014, as amended by Law 98 of 2015.
Under the Electronic Transactions Law, disclosing personal data without right, collecting it unlawfully or without consent, or using it for another purpose can bring up to 3 years in prison and a fine of 5,000 to 20,000 dinars, or one of the two. The penalty doubles for a repeat offence.
What Kuwait says about AI itself
I found no Kuwaiti law that regulates AI as such, as of October 2026. In its 2026 national connectivity strategy, CITRA states that it does not currently have a dedicated AI regulatory framework. The same document plans a CITRA AI policy for telecommunications in 2027. The strategy is a plan, not a law.
What this means for you
- First check whether your company holds a CITRA licence or falls within the regulation’s definition of a service provider. If it does, the regulation applies to you on top of the Electronic Transactions Law.
- Record the purpose for each kind of personal data the agent reads, and keep the agent within that purpose.
- Keep proof of consent where you rely on it.
- If you are a CITRA licensee, prepare to report a breach within 24 hours, and tell users before their data goes to a provider outside Kuwait.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.