Duty LXD-2788
Makes credit decisions, in Kuwait
Each law's tag says when it binds: since in force proposed proposed
Data Classification Policysince 5 lines
Data Classification Policy, version 2.3 (Communication and Information Technology Regulatory Authority, listed ) · Read the law's page
- Classify all digital data you process, store, modify, or transfer into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, Highly Sensitive Data) and label it accordingly.
- Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.
- Maintain a unified data catalog with metadata describing your classified data, and review the classification periodically.
- Transfer or remove Tier 3 and Tier 4 data from a data center's or server's storage before decommissioning that equipment.
- Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.
- This binds a data owner in Kuwait, meaning an individual, government entity, or private company that owns data and has authority to process, amend, copy, or store it; entities of a security or military nature are excluded from this four-tier classification scheme and may classify their own data as they see fit.
Parliamentary Proposal — Public Authority for Artificial Intelligence (PAAI) Bill (December 2023)proposed0 lines
Draft Bill on the Establishment of the Public Authority for Artificial Intelligence (PAAI), submitted to the National Assembly of Kuwait, December 2023