Kuwait’s National Cybersecurity Centre (NCSC) has introduced emergency measures allowing certain organisations to transfer and process sensitive data outside Kuwait, easing existing regulatory requirements in response to regional developments.
What has changed
- In October 2025, NCSC Decision No. 1 of 2025 established Kuwait’s national data classification framework, requiring organisations under the supervision of the NCSC to classify their data and obtain approval before transferring sensitive information abroad.
- In 2026, External Circular No. (1) of 2026 introduced a temporary exception: organisations that have not yet completed the approval process may transfer and process data through approved cloud providers (e.g. Google Cloud, Microsoft), subject to defined procedures.
Why this matters
- Enables sensitive data transfers without completing the full approval process
- Maintains business continuity during regional instability
- Reduces operational risks associated with local data storage
- Demonstrates a pragmatic response while maintaining regulatory oversight.
Who it applies to
“Concerned Entities” under Kuwait’s cybersecurity framework, including:
- Government entities (civil, military, and security)
- Public sector institutions
- Private sector organisations under NCSC oversight
- Other entities designated by the NCSC
What organisations need to do
Entities relying on this exception must:
- Notify the NCSC using the Request Form for Emergency Data Transfer (Form 7)
- Await NCSC approval/rejection (decision issued within 24 hours)
- Complete the full data classification process within 4 months
- Submit the Data Classification Document as required
Key considerations
Organisations should assess:
- Confirm if your organisation qualifies as a Concerned Entity
- Assess whether emergency transfer is necessary for continuity or risk mitigation
- Ensure readiness to complete the full data classification process within the 4-month window
- Use only approved cloud providers under framework agreements
How ASAR can help
ASAR can advise on whether your organisation falls under NCSC Decision 1/2025 and guide you through the procedure for emergency data transfer under NCSC Circular 1/2026.
For assistance, contact: asar@asarlegal.com
