Decree-Law No. 10 of 2026 on Regulating Work in the Digital Commerce Sector is Kuwait’s first comprehensive framework for online business. It runs to 45 articles across ten chapters and imposes registration, disclosure, invoicing, data retention and cybersecurity duties, with fines and the power to block non-compliant stores. In this article, Attorney Meshari Obeid Alenezi explains what online sellers must do.
Scope and purpose
- Instrument: Amiri Decree-Law No. 10 of 2026 on regulating work in the digital commerce sector.
- Structure: 45 articles in ten chapters.
- Aim: to balance encouraging innovation with protecting consumers and ensuring transparency and fairness in transactions.
- Who it reaches: online stores, platforms, and those providing logistics and payment services around them.
- Effective date (Article 45): one month after the implementing regulations are published in the Official Gazette.
Registration
- Article 3: no person may operate in digital commerce without being registered in the records designated by the ministry.
- Practical effect: operating an unregistered store is itself a violation, independent of anything you sell.
- Why it matters commercially: registration also strengthens proof of ownership of the business, which becomes important in disputes and on inheritance.
Consumer protection duties
- Article 11: providers must disclose clear contract terms, including product specifications, the final price, payment methods, delivery arrangements and the return policy.
- Article 12: an electronic invoice in Arabic must be sent immediately after the contract is formed, showing the price, total fees, delivery date and place, and payment method.
- Misleading content: displaying false data or statements that directly or indirectly deceive the consumer is prohibited.
- Article 17 — right of withdrawal: a consumer may withdraw within fourteen days of receiving a product, with a full refund through the original payment method, provided the item is unused and in its original condition. A shorter twenty-four hour window applies to premium goods.
Records, data and cybersecurity
- Article 24: providers must keep electronic records for a minimum of five years in secure form, preserving authenticity and source information and keeping them accessible.
- Article 32: providers must apply current cybersecurity standards and update data protection systems periodically against emerging threats, as detailed in the implementing regulations.
- Related instrument: Decision No. 2 of 2026 of the National Cyber Security Centre sets national baseline cybersecurity controls covering governance, risk, asset protection, access management, awareness, incident response and service continuity.
- Evidential value: those records are what a provider relies on when a customer disputes a transaction, so record-keeping is a defence as much as a duty.
Enforcement and penalties
| Measure | Detail |
|---|---|
| Correction notice | The ministry notifies a violator to correct the violation within 24 hours |
| Blocking (Article 34) | A non-compliant store may be blocked for up to 30 days, in coordination with the relevant authorities |
| Penalties (Article 39) | Imprisonment up to one year and/or a fine of not less than KD 1,000 and not more than KD 10,000 |
| Repeat offence | Penalties are doubled |
Compliance checklist for online sellers
- Register the business in the ministry’s designated records before operating.
- Publish clear terms: specifications, final price, payment, delivery and returns, in a place the customer sees before buying.
- Automate the Arabic invoice so it issues immediately on contract formation.
- Build the fourteen-day return process into your operations rather than handling it case by case.
- Retain records for five years in a secure and retrievable form.
- Review your cybersecurity posture against the national controls and document what you have done.
- Check advertising copy for claims that could be characterised as misleading.
Frequently asked questions
I sell through a social media account rather than a website. Am I covered?
The law addresses the digital commerce activity rather than the technical form the storefront takes, and Article 3 requires registration in the ministry’s records to operate in the sector. Selling through a social account does not by itself place you outside the framework, so the safer course is to assess your activity against the definitions and register.
Must the invoice really be in Arabic?
Article 12 requires an electronic invoice in Arabic sent immediately after the contract is formed, showing price, total fees, delivery date and place, and payment method. Issuing it in another language in addition is unobjectionable, but the Arabic invoice is the one the law requires.
A customer wants to return a used item after ten days. Must I refund?
The right of withdrawal under Article 17 applies within fourteen days of receipt and is conditional on the item being unused and in its original condition. A used item falls outside that condition, so the request can be declined on that basis, though your own published policy may be more generous and will bind you if it is.
What happens if my store is blocked?
Blocking under Article 34 is limited to a maximum of thirty days and follows a notice to correct the violation within twenty-four hours. The practical priority is to correct the violation and document that you have done so, since the block is a compliance measure rather than a final penalty.
If you operate an online business and need to review your compliance, you may book an appointment with the office of Attorney Meshari Obeid Alenezi or call 22204490.
Disclaimer: this article provides general legal information and is not a substitute for specialised legal advice.
Need Legal Advice?
Contact Attorney Meshari Al-Enezi — over 10 years of experience in Kuwaiti courts