Kuwait KDPPR Articles 3-4 lawful basis for processing Personal Data including: (1) Express written consent of Data Subject; (2) Performance of contract with Data Subject; (3) Compliance with legal obligations; (4) Vital interests of Data Subject; (5) Public interest; (6) Legitimate interests not overridden by Data Subject fundamental rights. Sensitive Personal Data (health + biometric + financial + religious + ethnicity + criminal record) requires explicit separate written consent. Consent must be specific + informed + free + unambiguous + withdrawable. Privacy notices must be transparent + plain Arabic + cover purposes + categories + recipients + retention + Data Subject rights + complaint mechanism + CITRA escalation. Data Minimisation - only collect what is necessary for declared purposes. Retention - delete or anonymise when purpose fulfilled unless legal obligation. Purpose Limitation - no use beyond original specified purpose without new consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.