← Back to Blog

Qatar and Kuwait are the two Gulf markets most often tacked onto a UAE site as an afterthought: a currency switch, a flag in the footer, done. They are also two countries with different data regimes, different payment rails and domains that are not open to everyone. Treating them as one "GCC" setting is how a site ends up legally exposed and unable to take a local customer's payment.

This is what the official sources say, country by country, and where they stopped short of an answer. On connectivity, the audience is certainly online: a CITRA survey, run in March 2019 with 3,000 respondents, found that 97.7 percent of Kuwaiti individuals use the internet daily and 58 percent of households use it for online shopping. It is a 2019 figure, so treat it as direction, not today's number.

1. Qatar: a data law with real penalties

Qatar's Law No. 13 of 2016 on Personal Data Privacy Protection applies to personal data processed electronically. The National Cyber Security Agency publishes an English copy, with the note that the official version is the one in the Official Gazette on almeezan.qa. The law defines a "Website Operator" outright: someone who runs a site, or offers products or services through it, and collects personal data from visitors. That is your site.

The text does not say whether the law reaches a business outside Qatar, so we do not claim it does or does not. If you are serving Qatari customers, build as though it applies. The parts that show up in a build:

The penalties are in the text. Articles 23 and 24 set penalties of up to QAR 1 million for breaches of provisions including consent, notice, retention, breach reporting and marketing, and up to QAR 5 million for breaches of the security duty, the special-data permission and the children's rules. Under Article 25, a legal person that commits an offence in its name or interest faces up to QAR 1 million.

2. Qatar: the shop, the payments and the domain

Payments. The Qatar Central Bank describes NAPS, launched in 1996, as the centralised system for card payments, with e-commerce among its services. QPAY, launched in 2005, is the gateway for online payments to merchants in Qatar. Fawran, launched in 2024, is the instant payment system between Qatari banks, and QPAY supports card-less payments through it. NAPS also supports tokenised transactions, which covers Apple Pay, Samsung Pay and Google Pay. Ask your gateway provider which of these it connects to, and whether your entity qualifies, before you design the checkout.

VAT. The General Tax Authority's investors guide states that Qatar has not applied the Value Added Tax. So there is no Qatari VAT line to show at checkout. This is a position, not a promise. Check it again before you launch.

The .qa domain. The Qatar Domains Registry, run by the Communications Regulatory Authority, says in its FAQ that .qa names are available to eligible commercial entities, ICT companies, citizens and residents, non-profits, schools, government and military bodies, subject to the eligibility rules in its policy. Every application goes through an accredited registrar, on a first come, first served basis. A UAE company without a Qatari presence should ask a registrar whether it qualifies before building around a .qa name. Until then, a /qa/ section on your main domain is the safe route.

3. Kuwait: a regulator's rule, with gaps in what we could read

Kuwait's data rule comes from the Communication and Information Technology Regulatory Authority (CITRA), not from a statute. Resolution No. 42 of 2021 adopted the Data Privacy Protection Regulation and says it applies to the public and private sectors in Kuwait, effective from publication in the Official Gazette and on CITRA's website.

Here we have to be plain. The document CITRA publishes contains the board resolution, not the regulation's articles, and we could not obtain them. So we cannot state what Kuwait requires on consent, transfers abroad, breach notification or penalties. Commentary suggests the regulation is aimed at communications and IT service providers and may have been amended since 2021, but we could not confirm either point. A Kuwaiti adviser can settle both in one call, and it is worth making that call before you collect Kuwaiti customer data at scale.

What CITRA does say, in its guidelines for website owners, is concrete. Your site should:

Those four items are cheap to build and give you a defensible baseline while the legal question is settled.

4. Kuwait: KNET and the .kw domain

The Central Bank of Kuwait notes that KNET was established in 1992 in partnership with local banks. It is the local network Kuwaiti shoppers know, so ask any gateway provider whether it supports KNET as its own payment option rather than only international cards, and start the conversation with a Kuwaiti bank early. We could not verify KNET's merchant onboarding rules or fees on an official page, so confirm both with the bank.

Domains. CITRA's .kw page says registration runs through accredited registrars and is for residents and registered entities in Kuwait. The .com.kw zone is reserved for registered commercial entities, and the plain .kw zone is marked "coming soon". CITRA's registration policy asks .com.kw applicants for a Ministry of Commerce and Industry licence, a trademark registered in Kuwait, or authorised use of an international trademark with evidence. For a UAE company, a trademark registered in Kuwait is the likely route, and protecting the brand there is worth doing anyway.

5. Arabic and speed for both

We found no official source requiring a whole website to be in Arabic in either country, and we do not claim one. Commercially the question settles itself. Qatari and Kuwaiti customers expect a first-class Arabic version, not a translated afterthought, and it should be written for Gulf readers rather than reused from a Dubai site. How we build both languages as equals is in Arabic website design and our guide to RTL design. Search behaves differently in Arabic too, which our Arabic SEO piece covers.

Speed is the quiet reason local visitors leave. A site hosted and cached for Dubai can be slower for people elsewhere in the Gulf, and Your Site Is Fast in Dubai and Slow Everywhere Else explains what to test. On where you host, Qatar's law is useful context: Article 15 bars a controller from taking measures that limit cross-border data flow, unless the processing breaches the law or risks serious damage. That does not remove your duties, but it means the law does not itself forbid keeping data in the UAE.

A launch checklist

  1. Privacy policy and collection notices in Arabic and English, stating purpose, tools and storage.
  2. Marketing consent kept separate, with a working unsubscribe on every message (Qatar Article 22).
  3. A retention period, and a breach plan that names who is told and who decides.
  4. Final prices shown clearly at product and checkout, and order emails that work as invoices.
  5. A Qatari gateway route (NAPS or QPAY, with Apple Pay) and a Kuwaiti bank for KNET, started before the build.
  6. A domain plan: .qa or .kw if eligible, a country section if not.
  7. Arabic copy written for Gulf readers, and speed tested from the region.
  8. A Kuwaiti adviser's answer on the data regulation, and a re-check of Qatar's VAT position.

Selling into Saudi Arabia as well? Its law is different again, and we cover it in our Saudi website guide. We build market-ready sites from Dubai as part of our web development work across the GCC, including custom websites built around local payments. Tell us what you are launching and we will tell you what the Qatar and Kuwait versions need.

This article is general information, not legal advice. Laws and regulations are as published by Qatar's National Cyber Security Agency, Qatar Central Bank, the General Tax Authority, the Communications Regulatory Authority, CITRA and the Central Bank of Kuwait, read on 13 November 2026, with the limits stated above. Confirm your obligations with qualified advisers in Qatar and Kuwait.