CITRA Data Classification and Data Residency Rules for Cloud in Kuwait

CITRA's Data Classification Policy sorted data into four tiers, and its Cloud Computing Regulatory Framework keeps tiers 3 and 4 inside Kuwait. Two things changed in 2024. CITRA repealed the classification policy in February 2024, and its privacy regulation, as amended by Decision No. 26 of 2024, binds CITRA licensees only. This guide sets out who each rule binds, which data it names, and where each kind of data can be hosted today.

This is a technical guide, not legal advice. Facts were last checked against the sources listed at the end on 27 September 2026.

The three documents people mean by "CITRA cloud rules"

In Kuwait, "CITRA rules" on hosting usually means one of three documents from the Communication and Information Technology Regulatory Authority (CITRA):

The tiers still appear in the framework's text, but the policy that defined them has been repealed. Chambers' contributors write that after the repeal, the framework for data storage and transfers "has become less clear".

The four data tiers, as CITRA defined them

The repealed policy asked data owners to sort data into at least four tiers. Definitions come from the policy (v2.3); hosting rules come from the framework (v2.4).

Chambers 2026 summarises the old policy as allowing tier 3 data in hybrid clouds "both inside and outside Kuwait". The framework text (Art. 3.2.1.2.2) requires the tier 3 part of a hybrid setup to stay in Kuwait, and that is the reading we follow.

Two details change how you design:

• The Civil ID number is tier 2, not tier 3. Under the policy's own examples, a customer table with names, phone numbers and Civil ID numbers was tier 2, and Art. 3.1.4.2 allows tier 2 in a public cloud if it is encrypted and only you hold the keys. Art. 4.2.1.1.3 (below) complicates this for anyone the framework binds.
• Encryption keys are tier 4. If you apply the tiers conservatively, the keys that protect your tier 3 data belong in Kuwait, even when the ciphertext sits somewhere else.

What the framework asks of subscribers

The framework also sets duties for customers ("subscribers"). Its preamble says its clauses bind "all parties concerned with using cloud computing services, unless otherwise stated". Its scope clause (Art. 1.4) names all public-sector subscribers, plus private-sector subscribers who host government data, and Chapter 3 lists duties for private and business subscribers as well. Under the framework text:

• Subscribers classify their own data and choose protection to match (Art. 3.2.1).
• Private-sector subscribers must not host individuals' personal data or government data in tiers 3 or 4 with a provider outside Kuwait (Art. 3.2.1.2.2).
• Tier 3 and tier 4 data must not be hosted or stored outside Kuwait "for any purpose, or in any form, whether temporarily or permanently" (Art. 4.2.1.1). That covers backups, replicas and log exports, not just the primary database.
• The same article also lists "personal data of individuals held with government agencies, private sector companies, or service providers, as stipulated in article 4.1.4" (Art. 4.2.1.1.3). Art. 4.1.4 requires "clear and explicit written permission" before personal data is used to infer identity. This sits awkwardly with Art. 3.1.4.1, which lets data below tier 3 go abroad. If the framework binds you, keep identifiable customer data in Kuwait unless counsel advises otherwise.
• Subscribers must not put their content in a public, hybrid or community cloud unless the provider is registered and licensed by CITRA (Art. 4.2.1.2). CITRA's English text says "shared content", but the Arabic original (محتوى مشترِك) reads as the subscriber's content.
• Your data stays your property. The provider may not view, modify, move or delete it without the owner's permission (Art. 3.1.2).

What changed in 2024

February 2024: the classification policy was repealed

GLA & Company's Chambers guide, last updated 10 March 2026, reports that CITRA repealed the Data Classification Policy in February 2024. The authors write that Kuwaiti law "does not generally address data localisation requirements, especially after the repeal". In their view, storing and transferring sensitive data is now governed mainly by the consent provisions of Law No. 20 of 2014 on Electronic Transactions.

They list two sector rules that still touch where records are kept:

• Healthcare facilities must keep a register and database of patient information (Article 60 of Law No. 70 of 2020 on the Medical Profession).
• Private-sector employers must keep a file for each employee (Article 80 of Law No. 6 of 2010 on Labour in the Private Sector).

The privacy regulation binds CITRA licensees only

DLA Piper's Kuwait entry says the Data Privacy Protection Regulation applies to "individuals and entities operating as service providers within the telecommunications sector and holding licenses issued by CITRA". Chambers, which cites the regulation as amended by Decision No. 26 of 2024, says the same. It is not a general data protection law for every business.

One nuance: DLA Piper notes that the regulation's definition of a service provider is broad and mentions websites, smart applications and cloud services. If you are unsure whether you hold a CITRA licence, ask counsel.

For licensees, DLA Piper summarises the main duties:

• Publish service information and terms in easy language, in Arabic and English.
• State why data is collected, and get consent.
• Disclose any transfer of personal data to foreign countries, naming them.
• Delete a user's data when they withdraw consent.
• Report a personal data breach to CITRA and affected users within 24 hours. Telling users is not required if appropriate protection measures were effectively applied to the affected data.

What still applies to every business

The Electronic Transactions Law (No. 20 of 2014) applies to private companies, government bodies and NGOs. DLA Piper summarises its core rule: do not collect or process personal information unlawfully, or without the person's consent. The Cybercrime Law (No. 63 of 2015) penalises unlawful access to, and disclosure of, personal and government data. DLA Piper also notes that Kuwait has no national data protection authority and no registration requirement.

Which rules apply to you: a scope check

Contracts can be stricter than the law. If a bank, ministry or large customer writes "data stays in Kuwait" into your contract, that clause governs your architecture whatever the regulation says.

Mapping each tier to a hosting option

Even with the policy repealed, the four tiers remain the most useful vocabulary for a data inventory in Kuwait, because the framework still refers to them. It is the first step in our digital transformation guide for SMEs.

A split architecture, step by step

1. Inventory first. List every data store: databases, object buckets, search indexes, analytics exports, backups and logs.
2. Label each store by tier. Put the tier in resource tags and in the schema documentation, so reviews can check it.
3. Keep stateless tiers anywhere. Web front ends, CDNs and tier 1 content can run in the nearest region for speed.
4. Pin tier 3 and 4 stores in Kuwait. Access them from the application over a private connection rather than copying them out.
5. Watch the side doors. Cross-region backup, disaster-recovery replicas, error trackers and log shippers are the usual way sensitive data leaves a country without anyone deciding it should. Third-party tools count too: a WhatsApp bot or AI assistant may send message content abroad, so check where it processes data before you plan WhatsApp AI agents.
6. Hold the keys locally. A key management setup inside Kuwait matches the framework's tier 4 treatment of keys.

Cloud regions in and near Kuwait (checked 27 September 2026)

Do not plan a launch around an unannounced region date. Design for portability (containers, infrastructure as code, standard database engines), so a later move to a Kuwait region is a migration, not a rebuild.

Contract terms to insist on

Chapter 6 of the framework lists what a cloud contract and SLA must cover. It is a useful checklist even if the framework does not bind you:

• Provider identity, business address and full contact details.
• The services and their permitted uses, fees, payment terms and termination.
• Data ownership stays with you, and data is used only to provide the service, not for advertising without consent.
• Security obligations and breach steps. Under the framework, providers notify subscribers within 72 hours of becoming aware of a breach (Art. 4.2.2.1).
• Subcontracting, with final responsibility on the provider.
• Business continuity with a tested disaster recovery plan.
• Exit: a copy of your content in a usable format, deletion on request, or transfer to a new provider.

Before any data leaves Kuwait, the framework also expects the provider to tell you in advance and get your consent (Art. 4.2.1.4). If you are choosing between a Kuwaiti team and one abroad, residency and contract jurisdiction belong in that decision. We cover both in local agency vs offshore developer.

Where Rukn fits

We design cloud architecture and migrations for businesses in Kuwait, and we can plan a split architecture that keeps sensitive stores in-country and everything else close to users. If you want your data mapped to hosting before a migration, see our cloud architecture and migration service in Kuwait.

We re-check this page against the sources and update the "last verified" date when anything moves.