Duty LXD-4429
Deploys a mental-health chatbot, in Kuwait
Each law's tag says when it binds: since in force proposed proposed
Law No. 63 of 2015 on Combating Information Technology Crimes (Cybercrime Law) — Unauthorized Access and Electronic Forgerysince 6 lines
Law No. (63) of 2015 on Combating Information Technology Crimes, State of Kuwait, in force
- Do not intrude into information technology systems or networks without authorisation, and do not exceed the access you have.
- Do not intercept data without authorisation.
- Do not commit electronic forgery, including manipulating digital media to misrepresent a person's identity.
- Do not commit digital fraud.
- Keep automated scraping clear of access controls and authentication walls. Scraping that circumvents them, or that is carried out with intent to commit a further offense, can fall within these prohibitions.
- Do not use AI-generated synthetic media to misrepresent a real person; the electronic forgery provisions apply to it.
Data Classification Policysince 5 lines
Data Classification Policy, version 2.3 (Communication and Information Technology Regulatory Authority, listed ) · Read the law's page
- Classify all digital data you process, store, modify, or transfer into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, Highly Sensitive Data) and label it accordingly.
- Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.
- Maintain a unified data catalog with metadata describing your classified data, and review the classification periodically.
- Transfer or remove Tier 3 and Tier 4 data from a data center's or server's storage before decommissioning that equipment.
- Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.
- This binds a data owner in Kuwait, meaning an individual, government entity, or private company that owns data and has authority to process, amend, copy, or store it; entities of a security or military nature are excluded from this four-tier classification scheme and may classify their own data as they see fit.
Parliamentary Proposal — Public Authority for Artificial Intelligence (PAAI) Bill (December 2023)proposed0 lines
Draft Bill on the Establishment of the Public Authority for Artificial Intelligence (PAAI), submitted to the National Assembly of Kuwait, December 2023