KuwaitData Classification Policy
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Governance, Retention
What it requires
- This binds a data owner in Kuwait, meaning an individual, government entity, or private company that owns data and has authority to process, amend, copy, or store it; entities of a security or military nature are excluded from this four-tier classification scheme and may classify their own data as they see fit.
- Classify all digital data you process, store, modify, or transfer into at least four sensitivity tiers (Public Data, Private Insensitive Data, Private Sensitive Data, Highly Sensitive Data) and label it accordingly.NIST CSF 2.0ID.AM-07
- Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.NIST CSF 2.0PR.DS-02
- Maintain a unified data catalog with metadata describing your classified data, and review the classification periodically.NIST CSF 2.0ID.AM-07
- Transfer or remove Tier 3 and Tier 4 data from a data center's or server's storage before decommissioning that equipment.NIST CSF 2.0ID.AM-08
- Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.NIST CSF 2.0GV.RR-02NIST CSF 2.0RS.AN-06
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected
- RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.5Destroying data in a way that fits its sensitivity and storage type.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
1 more
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
No penalty provision, criminal or administrative, appears anywhere in this policy's own text, which was read in full; CITRA's own described role is compliance monitoring backed by periodic CAIT reporting from government entities, not a sanction.
Who enforces it
Enforcement body
The Communication and Information Technology Regulatory Authority (CITRA), which the policy directs to issue related policies and guidelines and to monitor public and private sector compliance, coordinating with the Central Agency for Information Technology (CAIT) for quarterly compliance reporting from government entities. No penalty clause for non-compliance appears in the policy's own text.
Settledness
- As of
- Open questions
- Does a penalty for a private sector data owner's non-compliance with this policy exist elsewhere in CITRA's general regulatory or licensing power under Law No. 37 of 2014, as amended by Law No. 98 of 2015?
What this law does
This policy outlines a methodology for data classification for the public and private sectors. The data owner shall classify their data into at least four levels. Entities of a security or military nature of the country are excluded from adherence to the classification levels specified in this policy, and they have the option to classify their data as they see appropriate.
The data owner must encrypt all classified data that falls under Tier 3 and Tier 4 during transmission from one government entity to another, or when transmitted between different physical geographical locations of government entities; this applies to the private sector as well.
The data owner must ensure that all data classified according to the third and fourth levels are transferred or removed from data centers and servers before the disposition of the equipment of data centers and servers hosting the data. The data owner is required to create and maintain a data catalog which should include the metadata information and standards for its data in a unified format. This catalog should also be updated periodically.
The entity or company must form a data classification team headed by the senior management or their representatives, with the membership of each of the director of information security department, the director of the information technology department, in addition to the directors of the various departments who own data, whether the data is personal and pertains to subscribers or it is the entity or company data.
Directing the entity's employees to immediately report any breach in the implementation of this policy. Record breaches and take corrective actions. Issue policies and guidelines related to information and communication technology. Monitor the public and private sectors entities in implementing the policies and guidelines issued by the authority to ensure compliance.
Request periodic reports from the Central Agency for Information and Technology (CAIT) to analyze and measure the compliance and implementation of government entities with this policy. No penalty, civil or criminal, for non-compliance appears anywhere in the policy's own text.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .