Does CITRA's data protection regulation apply to an online store in Kuwait?

That is contested. Regulation No. 26 of 2024 is addressed to CITRA-licensed service providers, which an ordinary retailer is not, but its own definition reaches anyone running a website, smart application or cloud service that collects personal data. The question matters less than it looks: the Electronic Transactions Law's consent rule applies either way.

Regulation No. 26 of 2024 replaced Regulation No. 42 of 2021. It asks for explicit consent given with full disclosure of the conditions attached, not a bare notice that data is collected.