Kuwait Cloud Storage
CITRA, the government agency responsible for regulating the telecommunications and information technology sectors, passed a regulation on cloud storage and computing.
Cloud storage providers are now required to obtain a license from CITRA to operate and sell their services in Kuwait. Part of the licensing requirement is that some data be stored in Kuwait. CITRA has notified government agencies of the ban on storing data outside of Kuwait and provided a deadline to store all sensitive data within Kuwait by February 11, 2022. This deadline has been extended to April 11, 2023, to allow more time for Kuwaiti government entities to comply with the ruling. CITRA has said non-compliance with the new data license will results in fines or a ban from operating in the country.
Data Classification Tiers
CITRA’s data classification policy defines data spcifications within four tiers. Levels three and four of the policy are restricted and cannot leave Kuwait. This data must be stored in a data center within the State of Kuwait and be encrypted.
Level 1: Non-classified data: public information not protected from withholding by any law. Examples of this are policies, regulations, forms, and public data on websites.
Level 2: Private Insensitive Data: Data that indicates the identity of the data owner where such disclosure would not infringe on the privacy of a person. Example of this are name, job title, and email.
Level 3: Private Sensitive Data: Personal data about a person that would infringe on their privacy. Examples of this are: work plans, internal project reports, medical records, DNA, legal records.
Level 4: Highly Sensitive Data: Data that if disclosed would cause serious infringement on the privacy of the data owner, government, company, or others. Examples of this are encryption keys, sensitive government documents, military records.
The ban on level 3 and 4 data includes data from all ministries and government institutions, state-owned oil companies, the central bank of Kuwait, and other organizations. There is an exemption for the Ministries of Defense and Interior as they have specialized classification rules which are more tightly controlled.
Several cloud service providers have already been issued a cloud computing license from CITRA. The aim is to keep sensitive data from leaving Kuwait.
How to apply for Cloud Storage License
Cloud service providers should apply online to CITRA to obtain a permit or license to be allowed to conduct business with Kuwait’s public sector in accordance with the terms and conditions stipulated in the cloud computing regulatory framework and its appendices by following this link: The Service and Procedures.
To learn more about compliance with CITRA’s cloud computing license and other support to do business in Kuwait, please reach out to Rasha.Al-Muhtaseb@trade.gov.