Kuwait Outbound Calling Compliance: CITRA (2026)

Quick answer

Outbound calling in Kuwait is regulated by CITRA, with the telemarketing rules in the Regulation on the Protection of the Rights of Users issued by Resolution No. 69 of 2022. A licensee may not make marketing calls without the subscriber's prior consent, third-party commercial messages run on an opt-out, and there is no national Do Not Call register: each licensee runs its own stop-list database at subscribers' request. Commercial messages, voice or written, may be sent only between 07:00 and 22:00 Kuwait time.

Kuwait is unusual in the Gulf: the telemarketing rule is short, specific and covers voice explicitly. It is also narrow in who it binds, which is what most outbound teams get wrong.

Kuwait outbound compliance at a glance

Item	Position
Regulator	Communication and Information Technology Regulatory Authority, CITRA (الهيئة العامة للاتصالات وتقنية المعلومات), established by Law No. 37 of 2014 as amended
Law and date	Regulation on the Protection of the Rights of Users, Resolution No. 69 of 2022 of 21/04/2022; Data Privacy Protection Regulation, Resolution No. 26 of 2024; Caller Name Identification Bylaw, Resolution No. 28 of 2024
Licence needed	No telemarketing licence, register or sender-ID registration exists. The Regulation binds CITRA licensees; a third-party sender is bound through the operator. Prior CITRA approval is needed for telephone sales rules and mechanisms
Calling hours	07:00 to 22:00, "according to the time of the State of Kuwait" (Article 12.2(a)). The instrument states no UTC offset, so confirm it before configuring a dialler
Consent model	Prior opt-in for a licensee's own marketing calls (Article 15); third-party commercial messages run on sender identification plus an easy stop (Article 12.2(b)). Consent may be written, oral or electronic and a copy kept (Article 3.1)
Do Not Call list	No national register. Each licensee must build a database to stop receipt of unsolicited messages at subscribers' request (Article 12.1)
Caller ID rule	Article 15(d): the representative gives his name, the licensee he represents and the reason, and confirms the subscriber wants the call to continue. Caller-name display is limited to corporate entities
Recording rule	Mandatory. Article 15(b): the marketing call must be recorded, observing record-keeping requirements. No announcement wording or retention period is published
Data protection law	No standalone national statute (secondary source). CITRA's Data Privacy Protection Regulation, Resolution No. 26 of 2024, repealed the 2021 version and binds licensees wherever processing occurs
Penalties	Law 37/2014 Article 64: warning to remove within 30 days, three-month licence suspension, service or licence-term reduction, a fine up to KD 1,000,000 per violation, seizure, or revocation. Doubled on repetition, or twice the damage, whichever is greater

Who regulates outbound calling in Kuwait

CITRA was established by Law No. 37 of 2014 as amended by Law No. 98 of 2015, with an Executive Regulation issued by Council of Ministers Resolution No. 993 of 2015. Scope matters more than the regulator's name. Article 2.1 applies the Regulation to all service providers licensed by CITRA and all of their services, not to businesses at large. A non-licensee is reached indirectly: Article 12.2 obliges the licensee to bind anyone who wants to use its services or networks to send a commercial message to the time window and the sender-identification and opt-out conditions. A bulk sender or dialler operator is therefore bound by contract through its carrier. CITRA's 42-document regulation library and 73-decision register contain no telemarketing or call-centre instrument; the marketing rules live entirely in Articles 12 and 15.

Consent and opt-out

Article 15 is the opt-in rule: a licensee may not conduct telephone marketing to offer its services or products to a subscriber except after that subscriber's prior consent to receive such calls, and Article 15(h) adds that the subscriber must be able to block marketing calls free of charge at any time. Third-party commercial messages sit on a different model: Article 12.2(b) requires the sender to identify itself sufficiently and to give an option to stop receiving that type of message by a means easy to reach and use. That is opt-out, not opt-in.

Form and proof are settled. Article 3.1 requires explicit consent at subscription, written on the contract, oral or by electronic message, with the licensee keeping a copy. The Data Privacy Protection Regulation adds that the provider must in all cases be able to prove consent, requires an easy way to withdraw it, and requires deletion on withdrawal. A minor under 18 needs a guardian's written consent. Neither instrument sets an expiry for marketing consent, so consent persists until withdrawn.

Do Not Call

There is no national, regulator-operated Do Not Call register, and that is a positive finding rather than a research gap: CITRA's regulation library, decisions register and service catalogue were all enumerated and none carries a do-not-call or preference-service instrument.

The duty sits on each licensee instead. Article 12.1 requires the licensee to comply with CITRA's instructions on unsolicited messages, including establishing a database to stop receipt of that type of message at subscribers' request, and requires all licensees to provide that service. Not published: any scrubbing cadence, list-currency requirement or deadline for actioning an opt-out, so do not quote a frequency.

Calling hours and days

Article 12.2(a) sets the window: commercial messages may be sent between 07:00 and 22:00 according to the time of the State of Kuwait. It reaches voice as well as text, because Article 1 defines a commercial message as one of a commercial character sent by electronic means in any form, whether voice or written, including email and SMS, whether sent for a charge or free.

The instrument says only "the time of the State of Kuwait" and never names a UTC offset, so confirm it independently before hard-coding one. No day-of-week, weekend or public-holiday restriction exists: Article 12 carries only the window and the sender duties, and none of Article 15's eight conditions is a day rule. No regulator statement confirms whether the window applies identically on Fridays, Saturdays, public holidays or in Ramadan, so narrow rather than widen on those days.

Caller ID and number presentation

Article 15 is the script rule. Under 15(d) the representative must disclose at the beginning of the call his name, the licensee he represents and the reason for the call, and must confirm whether the subscriber wishes it to continue. Under 15(a) contact must be through the licensee's official channels or its approved distributor, and under 15(c) the person answering must be verified as the owner of the number or his legal representative.

Caller Name Identification is a regulated network feature under the Bylaw issued by Resolution No. 28 of 2024, in force from 1 January 2024. It gives the user a trusted caller identity before the call is answered, and name display is limited to calls from corporate entities only. Providers must obtain CITRA approval before operating it and verify that the displayed name matches the user's credentials.

Not published: any rule on CLI withholding or anonymous calls, and any registered-number or sender-ID regime for marketing. Spoofing is criminal under general statutes rather than a CLI rule, through Law 63/2015 Article 3(5) and Law 37/2014 Article 70(a).

Call recording and notices

Kuwait is the Gulf market where recording a marketing call is not optional. Article 15(b) requires the call to be recorded, observing record-keeping requirements, and Article 9.12 makes those records producible: on a subscriber complaint the licensee must give CITRA any information it requests about contracting or charges, whether evidenced by written contracts or through marketing calls.

Recording outside that basis is a crime. Law 37/2014 Article 67 punishes disclosing the content of a communication, or recording it without legal basis, with up to one year and a fine of KD 200 to KD 5,000, and Article 78 punishes using eavesdropping devices, doubled where they record conversations over telecom devices. Placing a phone under surveillance requires Public Prosecution authorisation. Not published: any recording announcement wording and any retention period.

Messaging rules for SMS and WhatsApp

Commercial messages carry the same 07:00 to 22:00 window and the same sender-identification and easy-stop duty as voice, because the definition is medium-neutral. Bulk A2P SMS is an interconnection matter rather than a marketing licence: Resolution No. 165 of 2024 obliges operators to interconnect for bulk-sold SMS and fixes the termination price at 5 fils per message.

Resolution No. 77 of 2024 tightened value-added services: written terms, the price stated by period, a one-time password verified before any subscription, cancellation at any time through all channels, and no service called free if the user must pay now or later.

Data protection and retention

Kuwait has no standalone general data protection statute; protection runs through sectoral legislation, and the Ministry of Justice register carries no such law. The instrument that matters for a contact centre is CITRA's Data Privacy Protection Regulation, Resolution No. 26 of 2024 of 7 February 2024, which repealed the 2021 regulation. CITRA's English page still lists the repealed 2021 PDF, so do not cite that as current.

Article 1 applies it to CITRA licensees that collect, process or store personal data, inside Kuwait or outside. Article 3 sets the lawful bases: consent, a legal obligation, protecting the user's data, identity determination, or a guardian's consent for a minor. There is no legitimate-interest basis, so for marketing the basis is consent. Article 4.11 requires consent before disclosing personal data to a third party for marketing unrelated to the services the user requested.

Cross-border transfer is notice and record, not authorisation: say where data is stored, notify the user before transferring outside Kuwait, and record the destination state. No adequacy list, standard clauses or prior approval is prescribed. Retention is deletion-on-trigger, not a fixed term: delete when the relationship ends, consent is withdrawn, the data is no longer needed, or the user is no longer a subscriber. One inconsistency to plan around: Article 4.15 gives breach notification 72 hours while Article 6.1 gives CITRA notification 24 hours. Build to 24.

Penalties and enforcement

Neither the Data Privacy Protection Regulation nor the Resolution 69/2022 Regulation carries fines of its own; both route into Law 37/2014. Article 64 lets CITRA take one or all of the following, proportionate to the breach: warn the violator to remove it within 30 days, suspend the licence for three months, remove the violation at the violator's expense, reduce the licensed services or licence term, collect a fine not exceeding KD 1,000,000 per violation, impound equipment, or revoke the licence. The fine doubles on repetition, or the violator pays twice the damage, whichever is greater.

Criminal exposure runs separately: up to one year and KD 200 to KD 5,000 for unlawful recording or disclosure, and a legal person pays double the fine prescribed. Consumer Protection Law No. 39 of 2014 adds an advertising track: goods and services may not be advertised without a licence from the competent authorities, advertising must be in Arabic at least, and breach carries up to six months and KD 5,000.

What changed in 2025 and 2026

Nothing on marketing. CITRA's decisions register shows the only 2025 and 2026 items as a June 2026 circular on unlicensed wireless devices, mobile number portability, passive infrastructure sharing and a set of April 2025 tariff decisions. The instruments that shaped the current landscape are all from 2024, and the telemarketing rules date from Resolution 69/2022 and have not been amended. Whether a standalone Kuwaiti data protection law is in preparation could not be confirmed either way.

How DialerBee supports each rule

Kuwait does not ship as a jurisdiction pack, so calling hours and the stop list are configured per tenant. That suits Kuwait, because the stop list is per licensee rather than national: the suppression list your platform enforces is the database Article 12.1 requires.

Compliance Autopilot checks each attempt against the suppression list, the calling-hours window, the consent record, the caller ID's ownership, the frequency limit and the phone format before the call is placed, so the 22:00 cut-off is enforced by the platform rather than an agent watching a clock. Consent is tracked per contact with its source, timestamp and channel, which is what Article 3.1 and the burden of proof both need. Recording is automatic with configurable retention per campaign and per tenant plus legal hold, which matters where Article 15(b) makes recording mandatory but sets no period. Scripts run in 11 languages including Arabic. These are compliance-supporting controls that help you meet your obligations; they do not replace legal review.

Kuwait outbound compliance checklist

Confirm whether your entity is a CITRA licensee or bound through your carrier's contract, and paper it either way.
Obtain prior CITRA approval for your telephone sales rules and mechanism if you sell services by phone.
Dial and message only between 07:00 and 22:00 Kuwait time, and verify the UTC offset before configuring.
Narrow the window on Fridays, Saturdays, holidays and in Ramadan, since no rule confirms it applies unchanged.
Take prior consent before marketing a licensee's own services, and keep a copy of that consent.
Run a stop-list database, give commercial messages a clear sender identity and an easy stop, and honour a block request free at any time.
Open every marketing call with the agent's name, the licensee represented and the reason, ask whether the subscriber wants it to continue, and verify the number's owner.
Record every marketing call and keep it retrievable for CITRA on request.
Delete personal data when consent is withdrawn, the relationship ends or the person is no longer a subscriber.
Build breach notification to the 24-hour figure in Article 6.1, not the 72-hour figure in Article 4.15.

Sources

Regulation on the Protection of the Rights of Users of Telecom and IT Services, Version 3.1, Resolution 69/2022 (CITRA). citra.gov.kw
Law No. 37 of 2014 as amended by Law No. 98 of 2015, consolidated text (CITRA). citra.gov.kw
Data Privacy Protection Regulation, Resolution No. 26 of 2024, 07/02/2024 (CITRA). citra.gov.kw
Caller Name Identification in Public Telecom Networks Bylaw, Resolution No. 28 of 2024 (CITRA). citra.gov.kw
CITRA regulatory decisions register, all 73 decisions with dates and in-force status, read 11 September 2026. citra.gov.kw
Law No. 39 of 2014 on Consumer Protection, via WIPO Lex. wipo.int
DLA Piper, Data Protection Laws of the World, Kuwait, accessed 11 September 2026 (secondary source for the absence of a standalone statute). dlapiperdataprotection.com

Frequently asked questions

Who regulates outbound calling in Kuwait?

CITRA, the Communication and Information Technology Regulatory Authority, established by Law No. 37 of 2014 as amended by Law No. 98 of 2015. The telemarketing rules sit in the Regulation issued by Resolution No. 69 of 2022, which binds CITRA licensees and reaches third-party senders through the operator's contract.

What are the permitted calling hours in Kuwait?

Commercial messages may be sent only between 07:00 and 22:00 according to the time of the State of Kuwait. The window covers voice as well as text, because the Regulation defines a commercial message as one sent by electronic means in any form, whether voice or written. The instrument names no UTC offset, so verify it before configuring a dialler.

Does Kuwait have a national Do Not Call register?

No. CITRA's regulation library, its 73-entry decisions register and its service catalogue carry no do-not-call or preference-service instrument. Instead Article 12.1 requires each licensee to establish a database to stop receipt of unsolicited messages at subscribers' request.

Do I need consent to make marketing calls in Kuwait?

For a licensee marketing its own services, yes: Article 15 bars telephone marketing except after the subscriber's prior consent to receive such calls. Third-party commercial messages run on an opt-out instead, with the sender identifying itself and giving an easy way to stop. Consent may be written, oral or electronic, and a copy must be kept.

Is call recording mandatory in Kuwait?

For a licensee's marketing calls, yes. Article 15(b) requires the call to be recorded, observing record-keeping requirements, and Article 9.12 requires those records to be produced to CITRA on request. No announcement wording or retention period is published, and recording without a legal basis is criminal under Law 37/2014 Article 67.

What fines can CITRA impose?

Law 37/2014 Article 64 allows a warning to remove the violation within 30 days, a three-month licence suspension, a reduction in licensed services or licence term, a fine not exceeding KD 1,000,000 for each violation, equipment seizure, or licence revocation. The fine is doubled on repetition, or the violator pays twice the damage, whichever is greater.