Many people find out by accident that their phone number has escaped their control. Messages start arriving from unknown numbers, calls come in late at night, they are dropped into chat groups they never asked to join, and marketing messages greet them by their full name. Sometimes the situation is far more serious: after a dispute, someone posts your phone number, your home address, a photo of your Civil ID or your car's licence plate on a public account, together with words that invite others to "deal with you". What began as a nuisance becomes a genuine fear for your safety and for your family. The questions that follow are simple: is this a crime under Kuwaiti law, and how do I stop my details from spreading any further?
This article deals with that specific problem: the disclosure of bare personal data, meaning the numbers, addresses, identifiers and vehicle details that identify a person and tell others where to find them. It does not repeat our guide on sharing private photos or videos without consent in Kuwait, nor our analysis of insults in group chats and the liability of group admins, nor our piece on a neighbour's camera filming your home. Here the focus is on data rather than images or insults as such.
Below we set out the legislative framework that applies in Kuwait, explain the decisive difference between disclosure intended to harm or incite and ordinary sharing or honest mistakes, and look at how the actual harm suffered, from nuisance calls to harassment and fraud, shapes the legal assessment. We then walk through the practical steps in order: how to preserve evidence so that it holds up before investigators, how to request removal from the platform, where to file a report, when a civil claim for compensation makes sense, and what you can do today to reduce the chance of it happening again.
The Short Answer
Posting someone's phone number is not automatically a crime in every case. But disclosure without consent becomes punishable, or at least gives rise to liability, in many common situations: where it is combined with an intent to insult, defame or incite others against the person; where the data was obtained unlawfully, for example by accessing an account, device or information system without authorisation; where the data is used to threaten, blackmail or defraud; or where the disclosure is part of deliberate harassment. In these situations the provisions of the Law on Combating Information Technology Crimes No. 63 of 2015 and the Penal Code No. 16 of 1960 may apply, depending on how the investigating authority characterises the facts.
On the civil side, the Civil Code No. 67 of 1980 makes anyone who causes harm to another through their fault liable to compensate it, and compensation covers both material harm and moral harm, including injury to a person's feelings, reputation, peace of mind and privacy. So even where the elements of a crime are not fully made out, the victim may still be entitled to damages if fault, harm and the causal link between them are proven.
To stop the spread, the practical sequence is: document immediately with screenshots showing the date, time, account name and link; report to the platform using its tools for the disclosure of personal information; file a report with the department of the Ministry of Interior responsible for combating cybercrime or with the competent investigating authority; and then assess with your lawyer whether a civil claim for compensation is worthwhile. Avoid a public confrontation with the person who posted, as it tends to amplify the post and can weaken your position.
The Legislative Framework
Kuwait does not have a single provision titled "the offence of publishing a phone number". Protection is spread across several laws that complement one another, and investigators and judges choose the provision that best fits the facts of each case. Understanding this spread matters to the victim, because it determines what needs to be shown in the report and which evidence deserves the most attention.
1. The Constitution and private life
The Kuwaiti Constitution guarantees personal freedom and the freedom and confidentiality of correspondence, and the legal system as a whole rests on respect for private life and the sanctity of the home. This constitutional foundation is not an offence-creating provision on its own, but it guides how statutes are interpreted and reinforces privacy as an interest worthy of protection. Lawyers rely on it to show the seriousness of an intrusion when arguing for compensation.
2. Law No. 63 of 2015 on Combating Information Technology Crimes
This is the statute closest to most modern cases of data disclosure, since publication nearly always takes place over an information network or through information technology. The law criminalises a range of conduct, notably: unlawful access to systems, accounts, devices and data; obtaining, copying or disclosing data without right; using the information network to threaten or blackmail; using it to commit fraud or to seize another person's money or data; and acts that infringe on private life or amount to insult and defamation when committed by electronic means. Publishing a Civil ID number or account details obtained through a hack, posting a number so that others can harass its owner, or using personal data to threaten someone are all scenarios that may fall within this law.
3. The Penal Code No. 16 of 1960
The Penal Code remains the general framework for criminal liability in Kuwait. It governs the general elements of offences, such as criminal intent, complicity and attempt, as well as offences of defamation, insult, threats, and the disclosure of secrets by those who learn them through their profession or employment. If the person who published your data is an employee or professional who came across it through their work, a breach of professional secrecy may be involved alongside any other offence. If the post attributes disgraceful conduct to you or uses language that attacks your honour, the rules on defamation and insult may apply; we cover those in our article on defamation, insult and slander in Kuwait.
4. The law on misuse of telecommunication devices
Kuwait has a specific law on the misuse of telephone communication devices and eavesdropping equipment, aimed at nuisance and harassment by phone and message. It may become relevant where publication of a number triggers a flood of deliberate nuisance calls or messages, whether from the poster or from people who received the number from them. Whether it applies is assessed by the investigator according to the facts and the identity of the person responsible.
5. The Civil Code No. 67 of 1980
The Civil Code lays down the general rule that every fault causing harm to another obliges the person who committed it to compensate, and it expressly recognises compensation for moral harm, that is, harm to a person's feelings, reputation, standing and sense of security. Disclosing someone's personal data without consent, even if it falls short of a crime, can constitute a tortious fault where the poster departed from the conduct of an ordinarily careful person who avoids harming others. We discuss how to pursue such a claim in a separate step below.
6. Data privacy regulation
Kuwait's telecommunications and information technology regulator has issued a data privacy protection regulation that imposes obligations on service providers and on entities that collect and process personal data: obtaining consent, defining the purpose of processing, and not sharing data with third parties without a lawful basis. This is particularly relevant where data leaks from a business or service provider to marketing companies. We outline the wider framework in our article on personal data protection in Kuwaiti law.
7. The Electronic Transactions Law No. 20 of 2014
The Electronic Transactions Law contains provisions on the protection of data and information collected in the course of electronic transactions and records, and it recognises the evidential value of electronic records and messages. That recognition helps victims when they rely on screenshots and messages to prove that publication took place.
Substantive Rules: When Is Disclosure a Crime, and When Is It a Civil Wrong?
The deciding factor is not the type of data alone but the full set of circumstances: how the poster obtained the data, where they published it, for what purpose, with what words, and what actually happened as a result. The most common scenarios are set out below.
Scenario one: being added to groups without consent
Adding someone to a chat group without asking is irritating, but in most cases it is not enough on its own to constitute a crime, especially where the person adding you knew your number lawfully, as a colleague, relative or former client, and the group has an ordinary purpose such as an announcement or organising an event. The quickest fix is technical: leave the group and adjust your privacy settings so that only approved contacts can add you. The picture changes if you are re-added repeatedly despite clearly objecting, if the group exists to mock or defame you, or if your number is exposed to strangers so that they can harass you. In those cases the conduct may move into deliberate nuisance or an attack on your reputation. The liability of group admins for content is covered in detail in our dedicated article.
Scenario two: posting a number on a public account to shame or retaliate
This is the most serious and, in personal and commercial disputes, the most frequent scenario. One person falls out with another over a deal or relationship and posts their number on a public account with words such as "this person is a scammer, contact him" or "call her and teach her a lesson". Here the act is not merely disclosure of a number; it is combined with an allegation of fact or incitement of the public against the owner of the number. Depending on the wording and context, it may be characterised as defamation or insult committed electronically, and the element of incitement to harassment may be treated as revealing intent and aggravating the harm. Even if the poster has a real claim against the victim, such as an unpaid debt, the law gives them the route of a court claim, not public shaming, and having a right does not justify broadcasting someone's data.
Scenario three: placing a number in an advertisement without the owner's knowledge
A person's number may be placed in an advert for a sale, rental or service they never offered, whether as a crude joke or as revenge, so that they receive a stream of calls from strangers. The harm lies in the disruption, lost time and distress, and may extend to reputational harm if the advert is offensive in nature. Intent is inferred from the choice of this particular person's number, the relationship between the parties and any repetition. Rules on nuisance by means of communication may overlap with civil liability here.
Scenario four: publishing a home address or location
Revealing where someone lives, particularly with a photo of the house, a map pin or hostile language, goes directly to personal security, because it enables others to physically reach the victim and their family. Investigators generally take this seriously where the circumstances show an intent to harm or incite, and it may overlap with the offence of threats if accompanied by an explicit or implied warning. A victim in this position should report without delay and state in the report any danger they fear to their safety.
Scenario five: publishing a Civil ID card or Civil ID number
A Civil ID card is not just an image; it is a document carrying a set of data that may, in some situations, be enough to impersonate its holder or attempt transactions in their name. Posting it publicly or circulating it in groups opens the door to fraud, and it may also suggest that the poster obtained it from an organisation that kept a copy during a transaction. If the card leaked from an employer or service provider, the question is not only the poster's liability but also that of the entity that failed to safeguard it. If your card has already been used in a transaction you never made, see our article on a Civil ID used for a loan or phone line without your knowledge.
Scenario six: publishing a car's licence plate
A licence plate is visible to everyone on a public road, which raises a fair question: can photographing and posting it infringe privacy at all? The answer depends on purpose and context. Photographing a traffic violation and sending it to the competent authority is entirely different from posting the plate on a public account with the owner's name and defamatory remarks, or with a call to track the driver down. Opinions differ on this point: some take the view that a plate is public information that the law does not protect as such, while others consider that linking it to a person's identity and publishing it to cause harm makes it part of that person's protected personal data. The answer rests with the investigating authority and ultimately the judge, on the facts of each case.
Scenario seven: data passed to marketing companies
When someone receives repeated marketing messages from businesses they have never dealt with, addressed by name and sometimes containing other details about them, the likely explanation is that their data passed from one entity to another without their consent. This differs from shaming, since the purpose is commercial rather than hostile, but it may still amount to a breach of the data privacy obligations imposed on service providers and may ground civil liability for the resulting harm. Identifying the source of the leak is the main challenge, and it may require formal requests and asking the sender where it obtained the number.
Intent to harm versus mistakes and ordinary sharing
Criminal intent is an essential element in most of the offences relevant here. Someone who passes a friend's number to a third person in good faith to help them get a job done, who sends a message to the wrong group by mistake, or who forwards a message containing a number without noticing it, is not treated like someone who deliberately published a number to hurt its owner. That said, the absence of criminal intent does not always remove civil liability: a person may still answer for their negligence if the mistake was serious and caused real harm. Investigators and judges infer intent from the surrounding evidence: the words used, the timing, the relationship between the parties, any prior dispute, repetition, and refusal to delete after being asked.
The role of harm: nuisance, harassment and fraud
Actual harm is not a condition for every offence, but it is central to any claim for compensation and is also strong evidence of how serious the conduct was. In this context harm tends to escalate in stages: nuisance from unwanted calls and messages; then deliberate harassment, bullying and threats from people who received the data; then damage to reputation and social or professional standing where the disclosure came with defamation; and finally direct financial loss where the data was used for fraud or identity theft. The more precisely the victim documents each of these, the stronger the report and the more persuasive the civil claim.
How the data was obtained
A question many people overlook is where the poster got the data in the first place. If it came from hacking an account, device or email, there is a separate offence of unlawful access, independent of the publication; we cover it in our guide to hacked accounts and impersonation in Kuwait. If it came from the poster's job, breach of secrecy and the employer's liability may arise. If the data was already public by the owner's own choice, such as a number in their business advert, reposting it in the same context rarely raises an issue, unlike reposting it to shame them.
Principles of the Court of Cassation
As far as published material goes, the Court of Cassation has not issued principles specifically titled "publishing a phone number". Its case law on criminal and civil liability, however, establishes general rules that apply directly to this subject. The most relevant are:
- Inferring criminal intent: The Court of Cassation has consistently held that criminal intent is an internal matter inferred from the circumstances of the case and the surrounding evidence, and that the trial court has discretion to assess it provided its reasoning is sound and grounded in the file. In practice, the wording of the post, its context, refusal to delete and any prior dispute are all matters to put before the court on intent.
- Assessing fault and harm: The Court of Cassation has consistently held that establishing fault, assessing harm and the causal link between them are questions of fact for the trial judge, not subject to review where the conclusion is reasonable.
- Compensation for moral harm: The Court of Cassation has consistently held that moral harm to a person's feelings, reputation or standing is compensable, and that the amount is a matter for the trial court, set so as to make good the harm without excess or shortfall.
- Effect of a criminal judgment on the civil court: The Court of Cassation has consistently held that a final criminal judgment binds the civil court on what it necessarily decided regarding the occurrence of the act and its attribution to the defendant, so the civil judge may not reopen those questions. Winning the criminal case first is therefore often a useful step towards compensation.
- Electronic evidence: The Court of Cassation has consistently held that weighing evidence, including electronic messages and records, falls within the trial court's discretion, which may rely on it once satisfied of its integrity and source. See our article on proof by electronic messages in Kuwait.
Methodological note: The principles above are expressed in general terms reflecting the settled direction of the Court of Cassation as found in published judgments and legal commentary. We have deliberately not cited specific appeal numbers to avoid any error of attribution. How these principles apply depends on the facts of each case, and they are no substitute for reviewing recent relevant judgments when preparing a claim.
Practical Steps and Documents
Speed and order make the difference in these cases. Published content can be deleted at any moment by its author, taking the evidence with it, or it can spread further and become impossible to contain. We recommend the following sequence.
Step 1: Document before anything else
Before you ask for removal or contact the poster, record everything. Take full screenshots that show the account name or the poster's number, the full text of the post, the date and time, the link where there is one, the number of views or reactions, and any comments that show the effect of the post. If it was posted in a group, capture the group name and its member list or member count. Save the link as text alongside the screenshot. If possible, record a screen video showing you navigating from the account's main page to the post itself, which helps show that the screenshot has not been fabricated.
Do not stop at the original post: document the consequences as well, including call logs from unknown numbers, nuisance or threatening messages, and any fraud attempts that used your data. This is your evidence of harm. Keep copies in more than one secure place, and do not edit or crop the files in a way that removes key details.
Step 2: Do not respond publicly
An angry public reply can be used against you and may pull you into an exchange of insults that makes you a party to a separate incident. A public reply also boosts the post and draws attention from people who had not seen it. If you need to contact the poster, send a short, polite private message asking for deletion and pointing out that the post is unlawful, and keep a copy. A refusal to delete after such a request is evidence of intent.
Step 3: Report to the platform and request removal
Most social networks and messaging apps provide reporting tools, usually including options for sharing private or personal information without consent, or for harassment. Choose the option that most accurately describes your situation and provide whatever information is requested. If the post is in a group, ask the admin to delete the message and remove the poster, and keep your request. Platform responses vary, and removal does not replace an official report where the matter is serious: removal stops future harm, but it does not hold anyone accountable.
Step 4: File an official report
Reports are filed with the department of the Ministry of Interior responsible for combating cybercrime, or with the competent investigating authority depending on the nature of the facts. Your report should give a brief, orderly account: when you discovered the post, where, who posted it if known, your relationship with them, and the harm you have suffered. Attach copies of your documented evidence. If the poster is hiding behind an anonymous account, the investigating authorities have legal means to request the information needed to identify them under the applicable procedures. The general rules of the Criminal Procedure Law No. 17 of 1960 govern this stage.
Step 5: Civil claim for compensation
The victim has two routes to compensation: joining a civil claim to the criminal proceedings before the criminal court, or bringing a separate civil action before the civil court under the Civil and Commercial Procedure Law No. 38 of 1980. Each has advantages. A civil claim joined to the criminal case saves effort and benefits from the criminal investigation, while a separate action may suit cases where the elements of a crime are not complete but civil fault can be proven. Your lawyer will help you choose, bearing in mind the limitation periods set by law so that your right does not lapse.
Step 6: Protect yourself after the incident
Alongside the legal steps, take immediate protective measures: tighten your app privacy settings, enable two-step verification, alert your banks and other institutions if your Civil ID has been posted, and be wary of any call asking for codes or details "for verification", which is one of the most common forms of fraud that follows a data leak.
Document checklist
- Full screenshots of the post showing the account, text, date and time.
- The link to the post or account saved as text.
- A screen recording showing access to the post, where possible.
- Logs of calls and messages received after the post.
- Any threatening, blackmail or fraud messages.
- A copy of your deletion request to the poster, admin or platform and any reply.
- Evidence of your relationship or prior dispute with the poster, if any.
- Names of witnesses who saw the post or received your data.
- A copy of the complainant's Civil ID.
- Evidence of any financial, health or professional harm.
Hypothetical Cases
Case one: a commercial dispute turns into public shaming
A woman bought an item from an online seller and a dispute arose over its quality. Instead of pursuing a complaint, the seller posted the buyer's phone number in a public story with the words "Don't deal with this customer, message her and tell her what you think". The buyer received a wave of abusive messages. Here disclosure of the number is combined with open incitement to harass, and the intent is almost evident from the words themselves. The buyer captured the story before it expired, photographed the incoming messages and filed a report. She may also claim compensation for the moral harm caused by the abuse and disruption. Whatever grievance the seller had, it did not justify this approach.
Case two: a number shared in good faith
A colleague asked a young man for the number of a maintenance engineer he knew, and he sent it. Later, the engineer received many calls from people who had passed his number around. There is no sign of an intent to harm on the part of the first sender, and the sharing happened in an ordinary context connected to the engineer's own line of work. Criminal liability is unlikely and a civil claim would be weak. The sensible solution is informal: the engineer asks his acquaintance to stop sharing the number and adjusts his settings or uses a separate work number. Not every instance of sharing a number warrants a report.
Case three: an address and Civil ID in a large group
After a family dispute, a man posted a photo of his relative's Civil ID and home address in a group with hundreds of members, along with a remark suggesting a threat. Within days, attempts were made to use the relative's data in transactions. Several characterisations are possible here: disclosure of sensitive identifying data, a remark that may be read as a threat, and potential financial harm through fraud. The relative documented the post and the group's member list, alerted his banks, filed a report stating his fear for his family's safety, and asked the group admin to delete the post. The investigating authority will decide the legal characterisation as the facts emerge, and accountability may extend to those who knowingly reposted the card.
Quick Comparison
- Added to a group for an ordinary purpose: usually a nuisance rather than a crime; leave and adjust privacy settings. The position changes with repeated re-adding after objection or a shaming purpose.
- Number posted with shaming or incitement: a serious case that may fall under the IT Crimes Law and the rules on defamation and insult; official report and compensation claim.
- Number placed in a fake advert: deliberate nuisance and possible reputational harm; intent is inferred from circumstances, with nuisance rules and civil liability overlapping.
- Address posted with a threat: a direct threat to personal security that may overlap with the offence of threats; urgent report stating the danger.
- Civil ID posted: risk of impersonation and fraud; report, alert banks and institutions, and trace the source of the leak.
- Licence plate posted: a matter of judgement depending on purpose and context; reporting a violation differs from shaming.
- Data held by marketers: a possible breach of data privacy obligations; ask for the source and consider civil liability.
- Good-faith sharing: usually no intent to harm; resolve informally, with narrow civil liability possible only for serious negligence causing harm.
Frequently Asked Questions
Is posting my phone number without my permission a crime in Kuwait?
Not always on its own, but it becomes punishable in many situations: where it is combined with defamation or incitement to harass, where the number was obtained unlawfully, where it is used to threaten or defraud, or where it leads to deliberate nuisance. The legal characterisation is for the investigating authority and then the court, based on the facts.
Which laws protect me if my data is published online?
Mainly the Law on Combating Information Technology Crimes No. 63 of 2015, the Penal Code No. 16 of 1960 for general principles and offences of defamation, insult, threats and disclosure of secrets, and the Civil Code No. 67 of 1980 for compensation, together with the data privacy regulation binding service providers.
Is adding me to a group without consent illegal?
Usually it is an annoyance that does not amount to a crime on its own, particularly if the purpose is ordinary. The position changes if you are re-added despite objecting, if the group exists to shame you, or if your number is exposed to strangers to harass you.
The poster says I owe them money. Does that justify posting my number?
No. A financial claim does not justify shaming or broadcasting personal data. The law gives creditors the route of court proceedings and enforcement, and a creditor who resorts to shaming may face liability despite being owed the money.
What if the post was deleted before I captured it?
Look for friends or group members who saw or captured it, collect their screenshots and details as witnesses, and document the consequences such as incoming calls and messages. Where necessary, the investigating authorities can request data from the relevant parties through legal procedures.
Are screenshots accepted as evidence?
Yes, they can be evidence that the court weighs. They carry more weight when complete and clear, showing the date, account and link, and when supported by other evidence such as screen recordings, witness testimony or information obtained by investigators.
The poster uses an anonymous account. Can they be identified?
In many cases, yes. Investigating authorities have legal powers to request the information needed to identify an account holder. Not knowing who the poster is should not stop you from reporting; include everything you know about the account and its links.
Can people who reposted my data be held liable, not just the original poster?
Those who repost knowingly, intending to harm or join in the shaming, may be held liable, since reposting widens the harm. Someone who forwarded without noticing or in good faith is in a different position. The judge assesses each person's circumstances.
Can I claim compensation even if the poster is not convicted?
In some cases, yes, because civil liability rests on fault, harm and causation and does not require all the elements of a crime. However, if a final criminal judgment finds that the act did not occur or was not committed by the defendant, the civil court is bound on those points.
I receive marketing messages addressed to me from a company I never dealt with. What should I do?
Keep the messages, ask the sender where it obtained your data, and request removal from its lists. If it turns out your data leaked from an entity you did deal with, that entity may be liable for breaching privacy obligations, and your lawyer can assess whether a claim is worthwhile given the harm.
Does posting my car's licence plate violate my privacy?
This is a matter of judgement on which views differ. The plate is visible on public roads, but linking it to your name and posting it to shame you or to encourage others to track you may amount to an intrusion. The question is for the investigating authority and then the judge, depending on purpose and context.
Is the group admin responsible for my number being posted in the group?
The starting point is that the poster is responsible. An admin's liability may arise in particular circumstances, such as taking part, endorsing the post or refusing to remove it after being made aware of it. We cover this in our article on group admin liability.
Is it enough for the platform to remove the post?
Removal stops future harm but neither holds the poster accountable nor compensates you. Where the matter is serious, such as shaming, threats or fraud, it is better to combine a removal request with an official report and a compensation claim.
Conclusion
Your personal data, your phone number, your address and your Civil ID number, is not just a set of digits. It is a set of keys that let others reach you, your family and your money. Kuwaiti law treats unauthorised disclosure seriously where it is combined with an intent to harm or incite, where the data was obtained unlawfully, or where it is used against its owner, and it offers the victim two complementary routes: criminal accountability and civil compensation.
At the same time, the law distinguishes between someone who sets out to cause harm and someone who shares a number in an ordinary context or makes an honest mistake. That distinction calls for a calm assessment. Sometimes tightening privacy settings and a polite request are enough; in other cases an urgent report is essential, especially where an address or Civil ID is exposed or the post is accompanied by a threat.
What usually decides the outcome is what the victim does at the outset: complete documentation before deletion, no public confrontation, an orderly report, and protection against follow-on fraud. A victim who documents well and acts methodically is far better placed to stop the harm and hold the person responsible to account. For the wider framework, see our articles on cybercrime in Kuwaiti law and photography without consent and the right to privacy.
Legal Notice
This article provides general legal information about Kuwaiti law. It is not legal advice and does not create a lawyer-client relationship. The rules described are subject to legislative amendment and to judicial application to the facts of each case, and the legal characterisation of data disclosure varies with the circumstances of each incident.
If your phone number, address or personal data has been published without your consent, the team at Yumnaak Law Firm can review your evidence, assess the legal characterisation, prepare and follow up your report, and bring a civil claim for compensation where the conditions are met. Reach us through our contact page or book an appointment to discuss your case.
