What are the penalties for collecting data without consent in Kuwait?

Criminal ones. Under the Electronic Transactions Law (Law No. 20 of 2014), unlawful collection or processing carries up to three years' imprisonment and a fine of not less than KWD 5,000. Under the Cybercrime Law (Law No. 63 of 2015), unauthorised access to data carries up to ten years' imprisonment and fines of KWD 5,000 to KWD 20,000.

Kuwait has no national data protection authority to issue a warning first, so the route runs through prosecutors rather than a regulator's letter. For CITRA-licensed service providers, CITRA can also act under its own law, including against the licence.