Kuwait Personal Data Protection Law and Patient Records AI

Category: Privacy & Compliance | Market: Kuwait | Keywords: Kuwait personal data protection AI patient records

Kuwait stands at an important regulatory juncture. For years, health data privacy in the country has been governed by a patchwork of sector-specific rules and general civil law principles rather than a single comprehensive data protection statute. That is changing. Kuwait has been actively working toward a dedicated Personal Data Protection Law, and the draft framework circulating among legal and healthcare communities in 2024 and 2025 signals a significant tightening of obligations for any organisation, including AI medical scribe vendors, processing health data in Kuwait.

This article explains the current state of Kuwait's data protection landscape for health AI, what the anticipated PDPL will require, and what Kuwait clinics and hospitals should be doing now to ensure they are compliant today and ready for what comes next.

## The Current Legal Framework for Health Data in Kuwait

In the absence of a comprehensive PDPL, Kuwait health data privacy is anchored in several existing instruments:

• Medical Liability Law (Law No. 25 of 1981, as amended): This law establishes the duty of medical confidentiality. Physicians and healthcare facilities are legally prohibited from disclosing patient information without consent, except in defined circumstances.

• Communications and Information Technology Law: Provides baseline protections for digital data and electronic communications, with provisions that apply to health information processed digitally.

• Public Health Law: Governs the collection and use of health data by the Ministry of Health, with provisions on data security and permitted disclosures.

• Civil Code provisions on privacy: Kuwait's Civil Code creates a general right to privacy that courts have applied to health information.

Together, these instruments create meaningful but imperfect protection for patient data. The gaps — particularly around data processor obligations, cross-border transfers, and breach notification — are precisely the areas a modern PDPL will address.

## What Kuwait's Anticipated PDPL Will Require

Based on the draft framework and Kuwait's GCC context, the anticipated PDPL is expected to include provisions aligned with the following principles:

Lawful basis for processing. Healthcare providers will need a valid legal basis for processing patient health data, with consent as the primary basis for AI-assisted documentation tools.

Special category data. Health data will almost certainly be classified as a special category, requiring a higher standard of consent and stricter handling requirements than general personal data.

Data processor obligations. AI scribe vendors operating as data processors will face formal obligations regarding data security, purpose limitation, and breach notification. Healthcare providers will need written data processing agreements with their AI vendors.

Data localisation. Kuwait is expected to follow the GCC trend toward data localisation requirements for sensitive health data, though the precise scope is not yet confirmed.

Individual rights. Patients will have rights to access, correct, and in some cases delete their health data, with AI-generated notes included in scope.

## What Kuwait Clinics Should Do Right Now

Waiting for a formal PDPL to come into force before acting on AI data governance is a mistake. The current legal framework already creates obligations, and the anticipated PDPL will apply retroactively to existing data processing arrangements in most scenarios. Kuwait clinics and hospitals deploying AI medical scribes should take these steps immediately:

• Implement a patient consent process that informs patients an AI tool assists with clinical documentation. Document this consent in the patient record.

• Select an AI scribe vendor with a documented data processing agreement and privacy-by-design architecture. Vendors who cannot provide a DPA should be disqualified.

• Confirm data storage location. Even without a formal localisation law, placing Kuwait patient data on servers in jurisdictions with poor data sovereignty protections creates risk.

• Ensure clinician sign-off on all AI-generated notes. This is required under the Medical Liability Law regardless of whether AI is involved.

• Document your data governance approach. A clinic that has clearly defined its AI data processing policy, consent procedures, and vendor obligations will be well positioned when the PDPL comes into force.

## AI-Generated Notes and the Medical Liability Law

One aspect of the current legal framework that is already settled in Kuwait is clinician accountability under the Medical Liability Law. The physician who signs a clinical note is legally responsible for its content, regardless of how the note was generated. AI assistance does not transfer legal accountability from the physician to the software vendor.

This means that a Kuwait doctor using an AI scribe must review every generated note for accuracy, completeness, and clinical appropriateness before signing. This is not a burden that responsible AI scribing imposes — it is a standard of care that the law has always required. AI scribing simply makes the process faster and more consistent.

## Protecting Patients Across AI-Assisted Consultations

Beyond regulatory compliance, Kuwait patients have a reasonable expectation of confidentiality that predates any PDPL. When a physician uses an AI scribe, the implicit promise of doctor-patient confidentiality extends to the tool that processes the consultation. Choosing a vendor with robust privacy architecture, no audio retention, and clear data processing obligations is not just a compliance decision. It is an ethical one.

## Conclusion

Kuwait's health data privacy framework is evolving, and the anticipated PDPL will formalise obligations that the current patchwork only partially addresses. The direction of travel is clear: greater patient rights, tighter data processor obligations, and more rigorous consent requirements. Kuwait clinics and hospitals that act now — implementing consent processes, demanding vendor DPAs, and confirming data localisation — will be well ahead of the regulatory curve when the PDPL arrives.

Internal links: Kuwait MOH Digital Health Roadmap, Bahrain NHRA Medical AI Compliance, AI Scribe Vendor Due Diligence UAE