It is reported that the Communication and Information Technology Regulatory Authority (CITRA), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

The Data Privacy Protection Regulation of 2021 broadly defines "data collection and processing" as well as the transmission of data. Data processing, and therefore also data transfer across borders, is lawful under limited circumstances, including with the consent of the data subject or in case of necessity to comply with a legal obligation (Art. 5). Firms shall notify data subjects if their data is transferred abroad (Art. 6.10), also providing information about how long and where data will be stored overseas (Art. 6.8). The Regulation is not applicable to security agencies.

Kuwait has not joined any agreement with binding commitments to open transfers of data across borders.

Kuwait does not have a comprehensive regime in place for all personal data, but it has sectoral regulations. The Communications and Information Technology Regulatory Authority released the Data Privacy Protection Regulation, No. 42 of 2021, which establishes rules around the collection and processing of personal data by communication and information technology service providers. Law No. 63 of 2015 regarding Anti-Information Technology Crime protects data and information and specifies penalties for imprisonment and fines for violations. Law No. 37 of 2014 regarding the Establishment of the Regulatory Authority for Telecommunication and Information protects personal data, photos, and videos. Moreover, in the financial sector, the Cyber Security Framework for the Kuwaiti Banking Sector establishes several data protection-related obligations. Labour Law No. 6/2010 for the Private Sector similarly sets out requirements that overlap and impact data protection in relation to employment. In addition, Law No. 20 of 2014 (the E-Commerce Law) requires that client data relating to positional affairs, personal status, health status, certain financial information, and other personal information must be retained privately and confidentially by the recipient and its employees. Such data may not be disclosed without client consent or a court order.

Banks and other financial institutions are required by the Anti-Money Laundering/Combating the Financing of Terrorism Law 106 of 2013 to retain a copy of transaction data for five years.

According to the Data Privacy Protection Regulation, the communications and information technology service provider is obliged to appoint a data protection officer. Art. 7.4 states that the service provider should keep records of processing activities provided that such records include, among other information, the name and contact details of the data protection officer. On the other hand, the service provider must provide (to users) 24-hour communication with the data protection officer in relation to all issues related to the processing of their personal data and the exercise of their rights under these regulations (Art 7.12). In addition, the service provider must, within a period not exceeding 72 hours following its knowledge of a breach of personal data, provide a notification to the authority. The notification should include, among other information, the name and mechanism of communication with the data protection officer (Art. 8).
A communications and information technology service provider is defined as a natural or legal person who provides communications and information technology services in Kuwait and who provides, manages, establishes, and creates a public communications network, operates a website, smart application or cloud computing services, collects or processes personal data or directs another party that collects and processes personal data on its behalf through information centres that they own or use directly or indirectly.

Kuwait lacks a comprehensive regime for the protection of trade secrets.

It is reported that in Kuwait's telecommunications market, passive infrastructure sharing is practised in fixed networks based on both mandatory regulations and commercial agreements. On the other hand, passive infrastructure sharing in mobile networks is practised but only on the basis of commercial agreements.

Arts. 23 and 24 of Law No. 68 require foreign entities conducting business in Kuwait to do so either through a local agent or a Kuwaiti partner, which is typically facilitated through the establishment of a Kuwaiti company with Kuwaiti participants owning at least 51% of the share capital. An exception to these restrictions on foreign ownership is when the relevant Kuwaiti company is established and licensed under Law No. 116 (Art. 12), which allows for increased levels of foreign ownership up to 100%. Law No. 116 permits the Kuwait Direct Investment Promotion Authority (KDIPA) to authorise, on a case-by-case basis, up to 100% foreign ownership in the following industries: communications infrastructure; information technology and software development; entertainment, investment management, among others. Although a Kuwaiti or Gulf Cooperation Council (GCC) national must own at least 51% of any local company, this requirement may be waived if non-GCC investors qualify to invest through KDIPA. A 2017 amendment to the 2016 Companies Law eliminated prohibitive requirements on limited liability companies.

Three private mobile telephone companies provide cellular telephone and data services to the country (Zain Kuwait, VIVA and Ooredoo). The government owns a significant minority interest in each of them, but foreign companies own majority interests in two of them.

It is reported that Kuwait mandates functional and accounting separation for operators with significant market power (SMP) in the telecom market.

The Public Tenders Law No. 49 of 2016 governs public procurement from the government. Art. 31 requires bidders to be a Kuwait individual or company registered in a commercial register. Art. 87 imposes a local content requirement on foreign bidders to purchase not less than 30% of the goods from local suppliers and, in addition, subcontract at least 30% of the work to domestic contractors - where such contractors are available.

It is reported that the process that manufacturers must undertake to pre-qualify new technologies by the government is lengthy and burdensome and lacks transparency. It is also reported that the often-lengthy procurement process in Kuwait occasionally results in accusations of attempted bribery or the offering of other inducements by bidders.

Kuwait is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

Arts. 23 and 24 of Law No. 68 require foreign entities conducting business in Kuwait to do so either through a local agent or a Kuwaiti partner, which is typically facilitated through the establishment of a Kuwaiti company with Kuwaiti participants owning at least 51% of the share capital. An exception to these restrictions on foreign ownership is when the relevant Kuwaiti company is established and licensed under Law No. 116 (Art. 12), which allows for increased levels of foreign ownership (up to 100%). Law No. 116 permits the Kuwait Direct Investment Promotion Authority (KDIPA) to authorise, on a case-by-case basis, up to 100% foreign ownership in the following industries: communications infrastructure, information technology and software development, entertainment, and investment management, among others. Although a Kuwaiti or Gulf Cooperation Council (GCC) national must own at least 51% of any local company, this requirement may be waived if non-GCC investors qualify to invest through KDIPA. A 2017 amendment to the 2016 Companies Law eliminated prohibitive requirements on limited liability companies.