Privacy policy under CITRA's Data Privacy Protection Regulation — Resolution No. 42/2021, replaced by Resolution No. 26/2024 (in force 19 February 2024): explicit consent before collection, a guardian's consent for under-18s, a policy in BOTH Arabic and English, and notification to CITRA of a breach within 72 hours.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY POLICY (سياسة الخصوصية) — DPPR
Legal entity name (Commercial Registration No. Commercial Registration (CR) number)
This policy is issued under the Data Privacy Protection Regulation (DPPR) of the Communication and Information Technology Regulatory Authority (CITRA) — Resolution No. 42 of 2021, replaced by Resolution No. 26 of 2024 (in force since 19 February 2024).
1. DATA WE COLLECT 1.1. Categories of data collected
2. WHY WE COLLECT IT 2.1. Purposes of processing 2.2. Legal basis: Legal basis — the DPPR requires EXPLICIT consent before data is collected or processed, unless another lawful basis applies. 2.3. Minors: Minors' consent procedure — a guardian's consent is required for data subjects under 18.
3. RETENTION 3.1. Retention period
4. THIRD PARTIES AND PROCESSORS 4.1. Third parties and processors
5. DATA BREACH NOTIFICATION 5.1. Data breach notification procedure — the DPPR requires notifying CITRA of a personal-data breach within 72 HOURS.
6. YOUR RIGHTS 6.1. Data subject rights and request channel: Data subject rights and request channel — the DPPR grants rights to modify or delete personal data and to withdraw consent at any time; subjects must also be notified of MATERIAL changes to this policy.
7. LANGUAGE 7.1. Policy languages: Policy languages — the DPPR requires the privacy policy to be published in BOTH Arabic and English.
Version date: Policy version date
— — — ⚠️ This is a boilerplate template, not legal advice. It is written under the Kuwait Private Sector Labor Law No. 6 of 2010 and related regulations and authorities (Public Authority for Manpower — PAM, under the Ministry of Social Affairs and Labor — MOSAL; Ministry of Commerce and Industry — MOCI; Kuwait Municipality/Baladia; Communication and Information Technology Regulatory Authority — CITRA; Ministry of Interior — MOI; Public Authority for Food and Nutrition — PAFN; Ministry of Health — MOH) as in effect in July 2026 — these regulations and digital platforms change frequently (work-permit transfer rules in particular have changed several times in 2026); verify against the current text before use. Have this template reviewed by a Kuwait-qualified lawyer and, for HR documents, checked against your own PAM-approved internal work regulations (اللائحة الداخلية) and posted penalties table (جدول الجزاءات) before use.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
Guardian consent required for under-18s
Statutory: notify CITRA within 72 hours
1 of 12 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.