Duty LXD-1189
Processes voice recordings, in Kuwait
Data Classification Policysince 5 lines
Data Classification Policy, version 2.3 (Communication and Information Technology Regulatory Authority, listed ) · Read the law's page
- Classify all digital data you process, store, modify, or transfer into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, Highly Sensitive Data) and label it accordingly.
- Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.
- Maintain a unified data catalog with metadata describing your classified data, and review the classification periodically.
- Transfer or remove Tier 3 and Tier 4 data from a data center's or server's storage before decommissioning that equipment.
- Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.
- This binds a data owner in Kuwait, meaning an individual, government entity, or private company that owns data and has authority to process, amend, copy, or store it; entities of a security or military nature are excluded from this four-tier classification scheme and may classify their own data as they see fit.