VPNs with servers in Kuwait

Law No. 37 of 2014, amended by Law No. 98 of 2015, created the Communications and Information Technology Regulatory Authority.

Decree-Law No. 102 of 2026, reported by the Kuwait Times as published in Kuwait Al-Youm No. 1811 in October 2026, replaces the Press and Publications Law (3 of 2006), the Audiovisual Media Law (61 of 2007) and the Electronic Media Law (8 of 2016), and takes effect six months after publication; as of 3 November 2026 it is not yet in force. Whether any of these reaches a VPN operator is not established.

Under Law 63/2015 the court may confiscate devices, programs and means used in an offence and may close the premises or website where it was committed, for up to a year, where the owner knew; closure is mandatory if the offence is repeated with the owner’s knowledge (art. 13).

The Law punishes creating a site or posting information to promote human trafficking or narcotics, with up to seven years and a fine of KD 10,000–30,000 (art. 8), and creating a site for a terrorist organisation or publishing information on it, with up to ten years and KD 20,000–50,000 (art. 10). Creating or sending material that offends public morals, or running a place for it, carries up to two years (art. 4(4)).

Under art. 53(B) of Law 37/2014, as replaced by Law 98/2015, the Public Prosecutor or the president of the competent criminal court may order material, links or sites related to communications or information technology to be prevented, stopped or withheld, for two weeks at a time, renewable, as an investigation requires.

Using the network to threaten or blackmail a person into doing or refraining from an act carries up to three years and KD 3,000–10,000, rising to five years and KD 5,000–20,000 where the threat is of a felony or touches a person’s dignity, honour or reputation (art. 3). Deliberately intercepting messages sent over the network without right carries up to two years, three if disclosed (art. 4(3)).

Articles 6 and 7 carry the Press and Publications Law online: whoever commits through the network the acts listed in arts. 19–21 of that law is punished under art. 27(1)–(3), and whoever commits those of art. 28 under art. 29(1) of Law 31 of 1970 amending the Penal Code.

Article 39 of the Constitution safeguards postal, telegraphic and telephonic communications and guarantees their secrecy; censorship and disclosure are permitted only in cases and by procedures set by law. Law 37/2014 makes private calls and telecommunications confidential and bars surveillance by any means except on authorisation from the competent judicial authority (art. 51); eavesdropping devices may be held only by official bodies designated by decree, with prior Public Prosecution permission (art. 46).

A Council of Europe comparison of April 2020 read the statutes as empowering the government to collect traffic data in real time and to intercept content, but as containing no power to compel a service provider to do so. The order of the rows is the security score, and a server’s location is not a recommendation.