Kuwait is the one Gulf country that still has no general personal data protection law. The rules are spread across the E-Transactions Law, the Cybercrime Law and a regulation issued by the telecoms regulator, CITRA. Does that mean it does not matter where AI runs in Kuwait? The sources say the picture is light today, but the direction is clear. This article summarises what they say, and where they disagree.

First: one data privacy regulation, with a disputed scope

CITRA issued Data Privacy Protection Regulation No. 26 of 2024, replacing Regulation No. 42 of 2021, according to Access Partnership. According to the Chambers Data Protection & Privacy 2026 guide, Kuwait chapter (GLA & Company), the regulation requires consent before collection with the purpose stated, gives individuals rights to withdraw, delete and correct, and requires breaches to be reported to CITRA and to affected users within 24 hours (Article 6). Users must be told about any transfer abroad and which countries it goes to (Article 4(11)), and CITRA approval may be required.

But who does it apply to? Chambers reads the 2024 version as narrowing the scope to CITRA-licensed telecom and internet providers. DLA Piper reads the definition of “service provider” more broadly, to include websites, apps and cloud services that collect personal data. The two sources differ, so ask your counsel which reading applies to you.

Second: the old classification policy is gone, but not everything is settled

In 2021 CITRA issued a cloud computing framework with a four-tier data classification policy, under which Tier 3 (private sensitive) and Tier 4 (government and national) data had to stay in Kuwait, according to the US International Trade Administration. Chambers and Access Partnership say CITRA repealed that policy in February 2024 alongside the new regulation, and that Kuwaiti law has since generally not addressed localisation.

However, a note published by Legal 500 in November 2025 (GLA & Company) says processing sensitive data outside Kuwait needs prior approval from the National Cybersecurity Center, set up by Decision No. 37 of 2022. The sources do not settle this point, and it is exactly the point that decides whether a cloud deployment needs approval.

Third: no AI law yet, but the roadmap is published

CITRA says in its own paper, Kuwait 5G-A & AI Era: National Connectivity Strategy 2025–2035 (July 2026), that it does not currently have a dedicated AI regulatory framework. But it is studying a tiered, risk-based framework for AI in telecoms, and proposes storing core network data in Kuwait on sovereign infrastructure, with standard contract clauses for transfers abroad. On the roadmap: updated localisation rules for 5G-Advanced operators in the fourth quarter of 2026, and an AI policy for telecoms during 2027.

As for the National AI Strategy 2025–2028, the Library of Congress described it as a draft in December 2024, and the Legal 500 note of November 2025 still called it forthcoming.

When running AI on-premises is the sensible choice in Kuwait

  1. When you are a government body, an oil company or a telecoms operator. These were within the old localisation rules, and CITRA is announcing new sovereignty rules for telecoms. Building inside Kuwait now costs less than moving later.
  2. When your systems read sensitive data. While the cybersecurity centre approval question is unsettled, keeping processing inside your premises removes the question altogether.
  3. When you operate in more than one Gulf country. One on-premises design works for Kuwait, Saudi Arabia, the UAE and Qatar together.
  4. In every case, log everything. Reporting a breach within 24 hours needs logs that tell you quickly who saw what, and when.

Where we stand

We will not tell you Kuwaiti law forces you to run on-premises today, because the sources do not agree on that. But the stated direction, from CITRA itself, is to keep important data inside Kuwait. Orchestra, our Arabic model, runs inside your data centre or in an in-country private cloud, understands Gulf Arabic, and comes with the indexes, the logs and the safety layer. For comparison, read about Saudi Arabia’s localisation draft, the UAE’s rules and Qatar.

This article summarises public sources and is not legal advice. The regulatory picture is moving, so check the official texts and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.