In Kuwait, data centers are mainly regulated by the Communication and Information Technology Regulatory Authority (CITRA) and its regulations.
Rana HegaziSenior Associate,Corporate Commercial
The digital transformation roadmap of the Kuwaiti government is to increase Kuwait data center market share. In light of latest reports, “the Kuwait data center market size was valued at USD 176 million in 2021 and is expected to reach USD 295.1 million by 2027, growing at a CAGR of 10.06% during 2021–2027[1]”. By the beginning of 2023, the government of Kuwait signed a strategic partnership agreement with Google Cloud to allow establishment of international standard data centers in the country[2]. In this article, we will address Kuwait regulations regarding data centers and requirements thereof.
In Kuwait, data centers are mainly regulated by the Communication and Information Technology Regulatory Authority (CITRA) and its regulations, including CITRA’s Regulation pertaining to Cloud Computing Regulatory Framework. The said regulation is applicable to the following:
all cloud computing service providers licensed by CITRA and data centers’ owners within Kuwait hosting third and fourth level of data (as defined under CITRA’s Data Classification Regulation[3]);
all cloud computing service providers registered and approved by CITRA hosting first and second level of data (as defined under CITRA’s Data Classification Regulation[4]) for all public sector subscribers; and
All public sector subscribers of cloud computing services and private sector subscribers hosting governmental data.
Cloud computing service providers are the authorized parties providing one or more of the cloud computing services to subscribers of such cloud. The service providers (i) can own data centers and manage them whether partially or fully, and (ii) use such centers to provide the relevant services, directly or indirectly (i.e., through a cloud computing service broker or sub-contractor/agent).
Infrastructure-as-a-Service (IAAS): In this model, the service provider hosts the infrastructure components that make up a data center such as servers, storage, networking hardware, and a subscriber’s virtualization layer. The service provider does not manage or control the basic cloud infrastructure, but he controls the operating system, storage, applications, and some protection systems, including but not limited to mainframe computers, storage, load balancers and virtual machines.
Platform-as-a-Service (PAAS): In this model, the service providers provide the environment that includes the hardware and software tools required to develop applications for subscribers via the internet. The service provider hosts hardware and software on its own infrastructure and thus exempts subscribers from purchasing an infrastructure to install new ICT solutions, including but not limited to application development, databases, middleware, testing tools and developer tools.
Software-as-a-Service (SAAS): The software distribution model in which the service provider hosts the applications and makes them available to the subscribers via the internet. Those include, but are not limited to government applications, web services, virtual computers, customer relationship management (CRM) systems.
Pursuant to CITRA’s Cloud Service Providers Regulations and Commitments, cloud service providers are prohibited to perform any cloud services without obtaining an operational license from CITRA to be renewed on an annual basis. CITRA has the right to impose adequate penalties and sanctions for failure to obtain such operational license.
Such cloud service providers must register with CITRA by submitting the supporting documents evidencing that it operates and owns the data center(s) in Kuwait through its related entities in the country.
CITRA does not monitor ownership restrictions to provide its operational license; however, it reviews the Kuwait Ministry of Commerce and Industry (MOCI)’s certificate including the relevant activity to provide the license to establish data centers.
Such license may not be provided to foreigners. In fact, Law No. 68 of 1980 of Kuwait (the “Commercial Law”) states that a foreign entity cannot conduct business activities in Kuwait except through (primarily) the use of: (i) a Kuwaiti agent; or (ii) by participating in the ownership of a separate Kuwaiti legal entity. As per the Kuwaiti Companies Law No. 1 of 2016 (the “Companies Law”), such legal entity may take various forms, with the most common forms being a shareholding company or a company with limited liability. Otherwise, foreigners may obtain an investment license from the Kuwait Direct Investment Authority (“KDIPA”), as per the Foreign Direct Investment Law No. 116 of 2013 (please refer to Al Tamimi & Company's Article on Foreign Investment in Kuwait[5).
Having said that and based on the strict interpretation of the foregoing, foreign data centers’ owners and operators must establish a Kuwaiti entity to obtain MOCI and CITRA’s licenses.
CITRA’s Cloud Service Providers Regulations and Commitments and Cloud Computing Regulatory Framework lists several requirements to be applied on data centers and complied with by its owners and operators; including the following:
Data centers must include infrastructures and operating platforms designated to host cloud averments fully or partially, through, which, the service provider intends to provide full or partial cloud services;
Owners and operators provide CITRA with the technical and non-technical specifications documents of the centers (including the data classification process, available equipment, and devices, applied security and protection standards;
Owners and operators must comply with data protection and classification regulations (please refer to Al Tamimi articles regarding data privacy regulations in Kuwait[6]); and
Data centers must comply with Resolution No. (67) of 2022 regarding the Data Hub and Transmission Circuits’ Tariff.
With the worldwide rush for digital transformation and the importance to protect data, Kuwait is on the right path regulating data centers and data protection, storage, and transfer in the country. It is expected that more regulations will be issued in the future to address the fast pace fourth revolution era implications.
For further information, please contact Rana Hegazi or Ola Saab.
Published in May 2023
[1] [2] [3] [4] [5] [6]
