How fast must a data breach be reported in Kuwait?

Within 24 hours, for service providers licensed by CITRA: Regulation No. 26 of 2024 requires them to report a data breach to CITRA in that time. Whether the regulation reaches an ordinary online store is contested, so if there is any chance its definition covers you, plan for 24 hours rather than the 72 used in Qatar or Oman.

The Cybercrime Law makes unauthorised access to data a serious offence, so the security measures in place before a breach matter as much as the report after one.