Kuwait has introduced a new decree-law to regulate its digital commerce sector, in a move aimed at strengthening consumer protection and boosting confidence in online transactions.
Decree-Law No. 10/2026 was published in the official gazette, Kuwait Al-Youm, setting out a comprehensive legal framework designed to keep pace with developments in the digital economy.
Under the new legislation, no business may operate in the digital commerce sector without registering with the Ministry of Commerce and Industry. The ministry will be responsible for overseeing implementation of the law, issuing regulatory decisions, establishing electronic registers for product and service providers, and setting registration systems and fees.
The new law obligates product or service providers to disclose their basic data and contractual terms, issue electronic invoices, provide a mechanism for receiving complaints, guarantee consumer data protection, and implement cybersecurity measures issued by the competent authorities.
The law includes a dedicated chapter on consumer protection in electronic contracts, recognising consumers as the weaker party in digital transactions. It grants consumers the right to correct errors before finalising a contract and to return products within 14 days of receipt or signing the agreement. Refunds must be issued using the same payment method and without additional charges in specified cases.
Digital advertising is also regulated. The law prohibits false or misleading information, content that violates public order or morals, unauthorised use of trademarks, and statements that could deceive consumers. A 24-hour grace period is allowed for businesses to rectify violations before further action is taken.
It permits the use of influencers in commercials, provided that the nature of the contractual relationship is disclosed, transparency is maintained, and no fraudulent or deceptive practices are promoted.
It also addresses the provisions for documents, records and electronic signatures, granting them legal validity if they follow the regulations and specifying the circumstances under which an electronic signature may be revoked.
Service providers must implement cybersecurity standards issued by the Central Bank of Kuwait and other relevant authorities, regularly update their systems to address threats, and restrict electronic payment services to electronic platforms.
The law requires entities licensed by the Central Bank to adhere to the regulations, while prohibiting the imposition of additional fees for using electronic payment methods, unless it is in accordance with the guidelines.
The law provides for the creation of two specialised committees: one to investigate and document violations, and another to resolve disputes between service providers and consumers. Serious breaches will be referred to the Public Prosecution.
Penalties include fines, doubled for repeat offences, closure of offending businesses, and confiscation of equipment used in violations. The de facto manager of a company may also be held accountable if proven aware of the breach.
It mandates the concerned minister issue the implementing regulations within one year of its publication in the official gazette. The law shall take effect one month after the regulations are published.