Kuwait's Camera Law After Decree-Law No. 76: Mandatory Destruction Ends and a Retention Policy Begins

Decree-Law No. 76 of 2026 was published in Kuwait Al-Youm, Supplement to Issue 1801, dated 29 July 2026, and operates from that date under Article Three. It makes two changes to Law No. 61 of 2015 on the regulation and installation of security surveillance cameras and devices. It replaces Article 5, which fixes how long recordings are kept, and it inserts Articles 8 bis and 8 bis 1, which let the competent authority settle certain breaches instead of referring them for prosecution.

Why this matters: Law No. 61 of 2015 reaches further into ordinary commercial life than most regulatory statutes. Article 1 brings in hotels, commercial complexes, cooperative societies, residential complexes, banks and exchange houses, gold and jewellery shops, clubs and youth centres, shopping and entertainment centres, hospitals and clinics, warehouses holding valuables or hazardous materials, and petrol stations, with room for the Council of Ministers to add others. Most businesses operating premises the public walks into are inside it. Until 29 July their retention duty was a fixed window with a hard stop. It is now a floor, and what sits above the floor is for each establishment to decide and to record.

What changed in Article 5

The repealed Article 5 required recordings to be kept for 120 days, prohibited any amendment, and required destruction immediately on expiry. The new text requires not less than 120 consecutive days, widens the prohibition during that period from amendment alone to any amendment, erasure, deletion or processing by any means, and then permits the establishment to adopt its own retention schedule proportionate to the nature of its activity and the size of its premises, subject to the security and regulatory requirements set by the competent authority.

The explanatory memorandum is candid about the reason. It treats the existing period as short in practice, since a victim may delay a complaint for reasons connected to the incident, so that by the time an investigating authority or court issues an order under Article 6 the footage has already been destroyed by operation of law. The stated aim is to simplify the route back to the recordings once the 120 days have run.

Two consequences follow. An establishment that deleted at day 120 was complying rather than over-complying, and may now stop. Less comfortably, keeping footage has become a choice, and choices are reviewable. An establishment holding a year of footage will be asked why, under what policy, and on whose authority.

The conciliation route and what it is worth

Articles 8 bis and 8 bis 1 create a settlement path that did not exist before. The competent authority, identified in the explanatory memorandum as the General Department of Security Systems, may accept conciliation on the application of an establishment recorded in breach of Article 2 (installation, round-the-clock operation, central control room), Article 4 (signage), Article 5 (retention) or Article 7 (maintenance). The application must be filed within seven working days of notification of the seizure report. Acceptance carries up to 30 days to rectify the breach and remove its effects against payment of the settlement sum, and failure to do both in time returns the file to the investigating authority.

The arithmetic is worth stating plainly: in each case the settlement sum is exactly half the statutory minimum fine. Article 5 attracts KD 1,000 against a minimum fine of KD 2,000 and up to three years' imprisonment under Article 12. Articles 2 and 7 attract KD 500 against a minimum of KD 1,000 and up to a year under Article 11. Article 4 attracts KD 250 against a minimum of KD 500 under Article 13. Conciliation converts an unpredictable criminal exposure into a fixed and modest cost, provided the seven-day window is not missed.

Two points deserve caution. Articles 6 and 9 sit outside the scheme, so unauthorised release of recordings and installation in privacy-protected places remain squarely criminal. And the operative text says completed conciliation extinguishes the criminal action against the violating establishment, while the explanatory memorandum says against the violator. Article 2 places the duty on owners and managers, and Articles 11 to 13 are addressed to whoever breaches, so whether a settlement by the establishment closes an individual manager's personal exposure is not settled on the face of the text. Until it is, a settlement receipt should not be treated as personal protection.

The implementing decision has not issued

Article 8 bis leaves the conditions and procedures of conciliation to a decision of the Minister, and that decision has not yet been published. The right exists from 29 July; the machinery to exercise it does not. An establishment served with a seizure report in the interim faces a seven-working-day window running against a route with no published form, evidence list or fee channel. File the request in writing with the General Department of Security Systems inside the window regardless, keep proof of delivery, and rectify in parallel rather than waiting on acceptance.

What belongs in the retention policy

No Kuwaiti statute of general application caps how long an ordinary establishment may hold camera footage. CITRA's Data Privacy Protection Regulation No. 26 of 2024 binds CITRA-licensed telecommunications and information technology service providers, not establishments at large. The discipline therefore has to come from the policy itself. At a minimum it should fix a default period above 120 days and justify it by the nature of the activity, allow different periods for defined camera zones, name who authorises retention beyond the default and what triggers it, record that nothing is amended, erased, deleted or processed inside the 120-day window, and route every disclosure through Article 6, which still permits release only on the written approval of the competent investigating authority or court.

WEFAQ advises clients within Article 1 to treat 29 July as a policy date rather than a hardware date. Nothing about the cameras needs to change. What needs to change is the document that explains, if the General Department of Security Systems or a court asks, why the footage that still exists still exists.

•   •   •

Source: Decree-Law No. 76 of 2026 amending certain provisions of Law No. 61 of 2015 concerning the regulation and installation of security surveillance cameras and devices, and its Explanatory Memorandum, Kuwait Al-Youm, Supplement to Issue 1801, pages 2 to 3, 29 July 2026; Law No. 61 of 2015, Articles 1 to 15, Ministry of Interior, General Department of Security Systems; CITRA Resolution No. 26 of 2024 on the Data Privacy Protection Regulation.

This article is provided for general information only and does not constitute legal advice. For advice specific to your circumstances, please contact WEFAQ Law Firm.