What the regulation covers

CITRA, Kuwait's Communications and Information Technology Regulatory Authority, issued a 2024 data protection regulation (reported as Regulation No. 26/2024) that replaced its 2021 regulation (reported as No. 42/2021). Published summaries describe it as applying to CITRA-licensed service providers that collect, process and store personal data and user content, and they describe requirements such as consent, purpose limitation, transparency and breach notification.

Where the scope is unclear

Sources do not agree on everything. Reported effective dates differ (one summary gives enactment in March 2024 and enforcement from 1 January 2025; another gives 19 February 2024). Breach-notification deadlines are reported as 24 hours in some summaries and 72 hours in others. Scope is described differently, with some summaries limiting it to telecom and ISP licensees and others applying it more widely. Some sources describe broader laws that were not confirmed in the regulation text. For a building owner, office or facility, the practical question is whether the regulation applies to you at all. That depends on whether you are a CITRA-licensed provider, and on any other rules that apply to your sector.

Confirm both points with Kuwaiti counsel before you rely on any deadline or scope statement in a design brief or a specification.

Design checks that apply in any case

Whatever the legal scope, CCTV and access control systems hold personal data. The following design checks are good practice and make later compliance work much easier:

  • Purpose and field of view. Define the purpose of each camera and aim it only at the area that purpose needs. Mark masking zones on the CCTV drawings where a camera would otherwise see private areas.
  • Notices. Show where people will see a notice about recording and access control, and what wording it should use.
  • Retention. Set retention periods for video and access logs per system and record the reason for each one.
  • Access to recordings. Use role-based access to live and recorded video, with logs of who viewed or exported it.
  • Data location. If video or access data is stored in cloud or hosted platforms, record where the data sits and who operates the platform.
  • Incident response. Include in the handover documents a short procedure for suspected data exposure, with named contacts, so the client can meet any notification duty that applies.

What to ask your counsel

  • Does the regulation apply to our organisation, and under which licence or sector?
  • What is the effective date and the current text in force, including any breach-notification deadline?
  • Do we need consent, notices or specific retention rules for CCTV and access control in our building?
  • Can we store video or access data outside Kuwait, and under what conditions?

This article is design guidance and not legal advice. Our design work applies privacy-aware settings within the agreed scope. Compliance decisions remain with the client and its advisers.

Sources