Kuwait
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Kuwait presents medium-high risk for web crawling with notable complexity in its data protection framework. The Cybercrime Law (Law 63/2015) criminalises unauthorised access to computer systems, data processing systems, and networks, with penalties up to 6 months' imprisonment and KWD 2,000 for basic access violations, escalating to 3 years and KWD 10,000 where personal data is deleted, altered, or disclosed. Kuwait's data privacy landscape is fragmented: the CITRA Data Privacy Protection Regulation (Decision 42/2021, narrowed by Decision 26/2024) applies only to CITRA-licensed telecom and IT service providers. The Electronic Transactions Law (Law 20/2014) and its executive regulations impose consent and purpose-specification duties for personal data held in electronic systems, but its scope and practical enforcement against commercial scrapers is uncertain. A comprehensive cross-sector personal data protection law applicable to all industries is not yet in force as of this record. Kuwait's copyright law protects databases under a compilation- originality standard; no EU-style sui generis database right exists, and there is no TDM exception. No scraping-specific case law is publicly available. Kuwait remains the GCC outlier without a full cross-sector PDPL.
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | broad criminal |
| Public-page carve-out | no |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | closed list |
| Text and data mining — commercial status | prohibited |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | CITRA Data Privacy Protection Regulation (Decision 42/2021 as amended by Decision 26/2024) — applies to CITRA-licensed telecom/ISP operators only; Electronic Transactions Law 20/2014 for personal data in electronic records; no cross-sector PDPL yet |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-24. Confidence: medium. Fast-moving area — verify before relying. Not legal advice.