Cybersecurity law & regulation in Kuwait (2026)

Kuwait's National Cybersecurity Centre issued a mandatory cross-sector baseline covering government agencies, military/security bodies, and critical private-sector entities across six control domains (Identify, Protect, Detect, Respond, Recover, Govern), aligned to ISO 27001 and NIST CSF, with an 18-month compliance deadline. This is the first unified mandatory standard applying simultaneously to both public and private sectors.

The National Cybersecurity Centre issued a binding framework requiring all entities handling electronic information to classify data into defined tiers and obtain NCSC authorisation before storing or processing Tier 3/4 (sensitive) data outside Kuwait. Directly feeds into the cross-border data-transfer controls enforced under both CITRA and NCSC regimes.

CITRA replaced prior data-privacy rules for telecommunications and information technology service providers, introducing detailed obligations on lawful processing, consent, 72-hour breach notification, and cross-border transfer authorisation. Represents the most comprehensive sector-specific data-protection update since CITRA's founding.

The National Cybersecurity Centre deployed a centralised Government Cyber Shield (GovShield) offering a 24/7 Security Operations Centre, continuous monitoring, real-time threat detection, penetration testing, and Active Directory assessments to all government ministries at no cost. Represents Kuwait's first structured national-level SOC capability for the public sector.

Published in Official Gazette Issue No. 1649, this decision established a binding governance architecture assigning cybersecurity responsibilities across the Supreme Committee, military/security entities, licensed service providers, and vital-sector organisations. The first substantive binding governance act issued by the newly created NCSC, translating the 2023-2027 strategy into enforceable duties.

Kuwait adopted a refreshed five-year cybersecurity strategy with priorities aligned to 5G deployment, cloud adoption, and digital-economy expansion, designating the NCSC as the central coordinating authority. Superseded the 2017 foundational strategy and provided the policy mandate for the wave of NCSC decisions that followed.

An Amiri Decree created Kuwait's National Cybersecurity Centre as the dedicated national authority for protecting information networks, telecommunications systems, and critical infrastructure, consolidating responsibilities previously fragmented across multiple agencies. Marked the formal institutionalisation of cybersecurity governance as a standalone state function.

Threat actors deployed LockBit ransomware against the Ministry of Commerce and Industry, disrupting government services and exposing systemic vulnerabilities in public-sector defences. The attack, one of several major incidents during a period when cybercrime cost Kuwait an estimated USD 160 million, reinforced the political momentum to create the NCSC.

CITRA mandated licensing for cloud service providers, tiered data localisation (Tier 3 and 4 data must be stored in Kuwait-based data centres), 72-hour breach notification, and service-level continuity obligations. Kuwait's first comprehensive cloud-specific security and data-sovereignty regime, covering both public-sector subscribers and private CSPs.

The government published its inaugural National Cyber Security Strategy with three pillars: cultivating a cybersecurity culture, safeguarding national assets and critical infrastructure, and advancing regional and international cooperation. Provided Kuwait's first overarching strategic framework for state-level cyber defence and signalled the move toward a formal national architecture.

Kuwait's principal cybercrime statute criminalised unauthorised access, data alteration, hacking, electronic fraud, and spreading misinformation, with escalating penalties for attacks targeting government or critical-infrastructure systems. Enacted June 2015 and in force from 12 January 2016; remains the foundational criminal law for cyber offences.