Cyber offences are prosecuted under the Law on Combating Information Technology Crimes, Law No. 63 of 2015. Preventive standards, by contrast, come from the supervisory authorities rather than from a single statute: the Central Bank of Kuwait alongside the Capital Markets Authority, for banks and financial institutions, and the Communication and Information Technology Regulatory Authority, established by Law No. 37 of 2014, for the entities it licenses. Companies outside both are to set their cyber framework in compliance with the National Center for Cyber Security.
For financial institutions we advise on the Central Bank's Cybersecurity Framework: governance and board reporting lines, risk assessment methodology, incident classification and reporting, third party and outsourcing arrangements, and the periodic testing and audit the Framework requires.
For CITRA-licensed entities we advise on the applicable technical and organisational standards, on the Cloud Computing Regulatory Framework and where data may lawfully be hosted, and on the notification obligations that follow a security incident. For companies in neither category we build the policy set to the risk the business actually carries, rather than to a standard imported from a jurisdiction that does not govern them.
When an incident occurs, the legal questions arrive in a fixed order and on a short clock: what must be notified, to whom and by when; what must be preserved; what may be said to customers, counterparties and staff; and what is being conceded by saying it. We act at that stage alongside the client's technical and communications teams, and we handle the reporting itself.
We then represent clients in the criminal complaints arising from an attack, in regulatory proceedings commenced by the supervisory authorities, and in civil claims for loss caused by a breach or system compromise. Before any of that, we advise on the cybersecurity provisions in commercial contracts: allocation of liability, indemnity, notification between the parties, audit rights and insurance.