Data Classification Policy
Saudi Arabia · Regulation · SDAIA
Our summary
This regulation establishes a framework for categorizing data held by Saudi public entities into four classification levels: Public, Restricted, Secret, and Top Secret, based on the impact of unauthorized disclosure. The policy applies to all types of recorded information and requires entities to assess and classify data upon creation or receipt, following principles such as open access by default, necessity, timely classification, and segregation of duties. It specifies impact criteria for each classification level relating to national interests, security, economy, and individual welfare.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
7 sections
Jump to a chapter
1 Data Classification Policy
6 sections
This chapter outlines the scope, principles, levels, controls, and processes for classifying data held by public entities. It also defines the roles and responsibilities involved in implementing data classification within organizations.
1.1 Scope
This Policy applies to all information that government bodies handle, create, or obtain through any channel, whether physical or digital. It covers various formats such as written papers, recorded conversations, digital communications, visual media, and stored electronic information.
1.2 Main Principles for Data Classification
Data classification must follow seven foundational principles: prioritize public access unless sensitivity demands restriction; balance value against confidentiality; classify promptly and within timeframes; apply the highest level when datasets mix classifications; separate duties to prevent conflicts; restrict access to those with legitimate need; and limit individual privileges to minimum requirements.
1.3 Data Classification Levels
Four primary data classification tiers are established: Top Secret for information whose disclosure causes exceptionally serious irreparable harm to national security, national interests, state sovereignty, government operations, or public health and safety; Secret for information causing serious harm to these areas; Restricted for information causing limited negative effects on entity operations, competition, or individual privacy; and Public for information with no negative impacts. Restricted data is further divided into Categories A, B, and C based on whether impact affects an entire sector or general economic activity, multiple entities or groups, or single entities or individuals respectively. Impact assessment applies across Kingdom reputation, diplomatic relationships, national security, national economy, national infrastructure, government entity functions, public order, private entity profits and functions, individual health and safety, privacy, and environmental resources, with impact levels ranging from Public to Top Secret based on severity of harm from disclosure or unauthorized access.
1.4 Data Classification Controls
Entities must use appropriate security controls based on classification levels for data handling, processing, sharing and disposal, with unclassified data treated as restricted until properly classified; controls include protective marking, least privilege access revoked upon termination, location or encryption restrictions, encryption of top secret, secret and restricted data when unattended, secure sharing methods, annually reviewed retention schedules, and secure disposal via electronic methods for secret/top secret data or cross-cut shredders for paper with disposal logs. Top secret and secret archived data must be encrypted with approved mechanisms and authorized access documented; data shall be declassified or downgraded when the classification period expires or protection is no longer needed, with declassification triggers including specified times after creation or receipt (two years), after last use (six months), specific calendar dates, or circumstances such as strategic priority changes or employee turnover, and users must notify the business data executive of wrongly classified data.
1.5 Data Classification Process
Entities must prepare a data inventory, assign classification responsibility to a business data executive, and conduct an impact assessment examining disclosure, unauthorized access, amendment, destruction or timely access consequences, applying the open by default principle unless higher classification is needed (top secret as default in political and security sectors, higher classification in development sectors). Impact levels are determined by consequences: high (extremely grave long-term unrecoverable damages), medium (grave long-term difficult-to-control damages), low (limited short-term controllable damages), or no impact (no damage), considering duration, recovery time and scope across national interest, entity activities, health or safety, and environmental resources. For low-impact data, entities must assess whether disclosure conflicts with kingdom laws including anti-cybercrime and e-commerce laws (classifying as restricted if conflict exists), then assess whether disclosure benefits such as new services, transparency or citizen engagement outweigh negative impacts (classifying as public if benefits outweigh or restricted if not); a data management office employee must review classification within one month to verify appropriateness, and entities must apply relevant controls.
1.6 Roles and Responsibilities within the Entity
Four key roles manage data classification: the Business Data Executive classifies data and ensures consistent protection across departments; the Data Classification Reviewer approves classifications; the Business Data Steward implements technical controls and maintains systems security; and Data Users access and use data within authorized parameters.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 3 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 1 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 1 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 8 are shown.
1.2 8 controls
- ObligationApplies to: DeployerDrafted by the Index
Data in development sectors must be open for access by default unless its characteristics or sensitivity warrant stronger protection.
- ObligationApplies to: DeployerDrafted by the Index
Data in political and security sectors must be classified as top secret by default unless its characteristics or sensitivity permit lower protection levels.
- ObligationApplies to: DeployerDrafted by the Index
Entities must classify data by weighing its utility against the need to keep it confidential.
- ObligationApplies to: DeployerDrafted by the Index
Entities must classify data when it is created or received, with time limits for completion.
- ObligationApplies to: DeployerDrafted by the Index
When a dataset combines different classification levels, entities must apply the strictest level to the whole dataset.
- ObligationApplies to: DeployerDrafted by the Index
Entities must separate the functions of workers who classify, access, disclose, use, modify or destroy data to prevent power overlap.
- ObligationApplies to: DeployerDrafted by the Index
Data access must be given only to the fewest people who have a legitimate operational need for it.
- ObligationApplies to: DeployerDrafted by the Index
Staff members' access rights must be limited to the minimum needed to perform their assigned duties.
Change history
No changes recorded since we began monitoring this policy.