Kuwait

Generally, there is no specific data protection or personal privacy legislation in Kuwait. However, there are certain provisions within certain laws (such as among others, Law No. 32 of 1968 With Regard To Currency, Central Bank of Kuwait, And the Organization of the Banking Profession, Law No. 2 For the Year 2001 Regarding the Establishment of a System for Gathering Information And Data Concerning Consumer Loans and Credit Facilities, Law No. 25 for the year 1981 Regarding the Practice of Human and Dentistry Medicine and their Supporting Professions etc) that govern the protection of an individual’s personal information with respect to consumer or financial related transactions, as well as prohibiting the disclosure of certain information concerning healthcare or medical treatment. Notwithstanding the above, these provisions do not explicitly impose obligations concerning IT security.
However, Law No. 20 of 2014 Pertaining to Electronic Transaction (the “ET Law”) provides that state bodies, authorities, public institutions, companies or non-state bodies or those working therein shall set forth the necessary procedures for protecting the personal information and data registered in the electronic processing records or systems pertaining to the professional affairs or social status, medical status, or financial dues of persons other personal information registered at one of the bodies stated herein from loss, damage, disclosure, exchange with untrue information or entering untrue information.