Data Management and Personal Data Protection Standards
Saudi Arabia · Standard · National Data Management Office
Our summary
This comprehensive standards framework governs data management and personal data protection across Saudi Arabian government entities and their business partners. It covers 15 domains including data governance, security, classification, and open data practices. All public entities must implement these standards and report compliance annually to the National Data Management Office.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
24 sections
Jump to a chapter
1 Definitions
This section defines key terms used in the standards, including data management as the process of developing plans and practices to manage data as an organizational asset, data controllers and processors as entities determining or executing processing, data subjects as Saudi citizens identifiable from data held by controllers, personal data as any element identifying a Saudi citizen, and public entities as governmental bodies or companies operating public utilities or services. A trusted source is defined as an upstream data source verified as reliable in the past, and unprocessed data is data that has not undergone processing and is exchanged in its raw format.
2 Introduction
This section explains that DAMA, a global association founded in 1980, provides international references and frameworks for managing information systems. Saudi Arabia has adopted these frameworks to develop standards governing how public sector organizations handle and safeguard information assets, with the National Data Management Office directing their implementation across government entities.
3 Purpose and Scope
These standards were established by Cabinet directive to govern information handling across 15 domains and apply to all public sector organizations and their business partners who work with government information. The standards cover all recorded materials in any format, from physical documents to digital files.
4 Compliance and Enforcement
Requires entities to conduct annual compliance audits and submit reports to the National Data Management Office by the third quarter each year, using a binary scoring system for each specification and cascading results up to domain and entity levels. The Chief Data Officer must lead the assessment, and the office may conduct additional audits to validate findings.
5 Data Management Guiding Principles
Establishes seven core principles to guide the standards: treating government data as a national asset, protecting personal data by design, making data open by default, ensuring ethical practices, adopting human-centric approaches, enabling data-driven decisions, fostering a learning culture, and building trust through quality and transparency. Each principle maps to specific domains within the framework.
6 KSA Data Management and Personal Data Protection Framework
The framework defines 15 domains spanning the data lifecycle from creation to retirement, covering governance, cataloging, quality, operations, document management, architecture, reference and master data management, business intelligence, and data sharing. The remaining domains address open data for transparency and innovation, freedom of information for citizen access to government data, data classification based on impact assessment, personal data protection of subjects' information, and data security and protection under the National Cybersecurity Authority's mandate.
7 Control Structure
The standards organize requirements into a three-tier framework: domains represent knowledge areas, controls group related specifications within a domain, and specifications define the required outcomes for compliance. Each domain breaks into controls, which further break into specifications that describe the activities and tasks needed to achieve compliance.
8 Specifications Prioritization
The 191 specifications across 77 controls are divided into three priority levels based on implementation order: Priority 1 covers foundational capabilities for year one, Priority 2 improves capabilities for year two, and Priority 3 advances maturity for year three. All adopting entities must follow a three-year roadmap with milestones at the end of each year for full compliance.
9 KSA Data Management and Personal Data Protection Standards
15 sections
This section presents the specific controls and specifications organized across 15 domains of the data management framework, segmented into three priority levels. The Data Governance domain comprises 8 controls and 28 specifications providing authority and control over the organization's data management practices.
Data Governance Domain
Entities must create a comprehensive data management strategy for 3-5 years with vision, goals, performance metrics, and budgets, adopt national guiding principles, develop a 3-year implementation plan, obtain formal approval from the Data Management Committee and senior executives, conduct policy gap analysis, and train all relevant employees on applicable laws and standards. They must establish a Data Management Office and Committee with specified roles including Chief Data Officer, Data Governance Officer, Open Data Officer, Compliance Officer, Personal Data Protection Officer, Business Data Executives, and Business Data Stewards aligned to the NDMO Organizational Manual, and establish compliance management practices defining audit scope, planning, reporting, remediation, and documentation of results showing compliance status, findings, recommendations, responsible parties, and completion dates. Entities must conduct periodic reviews of their plan, implement communications on program effectiveness, establish key performance indicators on role assignments, committee meetings, strategy development, training participation and compliance scores, define continuous improvement mechanisms, keep a register documenting approved data governance decisions with justifications, track data management issues historically, and establish a structured control system for all data management documents and artifacts.
Data Catalog and Metadata Domain
Entities must develop a Data Catalog Plan with implementation roadmap, resources, budget, prioritized data sources, approval processes, role-based access, and employee training; assign and maintain both business and IT data stewards to registered metadata; establish documented workflows for registering, populating, updating and certifying metadata following national guidelines; manage metadata quality by tracking issues with defined resolution timelines and reviewing annotations and trust certificates. Entities must implement an automated Data Catalog tool as an inventory with automated metadata management per national guidelines, automated change notifications, and user activity tracking with audit logs; keep the tool updated to the latest vendor release or document why the latest release is not applicable; and establish key performance indicators measuring catalog adoption and metadata quality across completeness, accuracy and consistency dimensions.
Data Quality Domain
Entities must create a Data Quality Plan with Initial Data Quality Assessment covering business requirements, quality rules, data profiling and remediation plans; develop and document Data Quality Rules for six dimensions (completeness, uniqueness, timeliness, validity, accuracy, consistency) with owner assignment and metrics; monitor quality regularly, establish issue resolution processes with Service Level Agreements, and deploy automating tools. Entities must establish key performance indicators measuring quality trends and issue resolution, conduct quality reviews during software development, allow data users to report issues through a data catalog workflow, and publish quality rules and monitoring results as metadata in the data catalog according to national office guidelines.
Data Operations Domain
Entities must create data operations, storage and retention, backup and recovery, and document management plans with implementation roadmaps and resource allocation; conduct periodic capacity forecasts and performance monitoring; establish processes for database access, change control, and disaster recovery with defined recovery objectives; create policies covering storage conditions, naming conventions, classification, retention and disposal; implement document and content management systems with specified capabilities for storage, versioning, search and OCR; and establish role-based access controls, service level agreements, staff training, and key performance indicators.
Document and Content Management Domain
Data Architecture and Modeling Domain
Entities must create a data architecture plan with activities, milestones, resource and budget allocation, and publish a policy requiring target architecture to align with strategic requirements, integrate with enterprise architecture, adopt a recognized framework like TOGAF or Zachman, and keep data models current. Entities must define baseline and target-state data architecture covering data models at conceptual, logical and physical levels, key processes, system components and visualized data flows, incorporating vendor-neutral big data frameworks and addressing data ingestion, infrastructure, distributed storage and partitioning strategies for real-time and batch processing. Entities must select a diagramming method and implement toolsets for data architecture design, data modeling with reverse engineering, and data lineage tracking; establish an architecture change management process; incorporate data architecture checkpoints into software development lifecycle to verify component reusability and conformance with enterprise data models; establish key performance indicators to measure capabilities and track progress toward target state; and maintain a register of project documentation, reference materials and data model designs.
Data Sharing and Interoperability Domain
Entities must assess data movement needs, create target integration architecture and implementation plans, and train employees on data sharing obligations. Before deploying to production, entities must document integration requirements and solution design, test all aspects, establish ETL and ELT processes, create a data sharing request channel on their government website routing to the Data Office, design internal and external Data Sharing Agreements (signed by Business Data Executive and requestor, covering purpose, lawful basis, sharing details and liability, with regular audits), and track metrics including data transfer rates, latency, request volumes, and average request evaluation duration in days.
Reference and Master Data Management Domain
Entities must develop a Reference and Master Data Plan with a roadmap, resources and budget, identify and categorize Master Data Objects and Reference Data as internal or external, and develop lifecycle requirements covering processes, matching rules, data quality standards and security. Entities must choose one of four Master Data Hub architecture designs (Registry Hub, Repository Hub, Coexistence Hub, or Centralized Hub), document conceptual and information architectures, define technical requirements for workflow management and versioning, and establish Service Level Agreements and Key Performance Indicators including incorrect data values and mean time to repair. Entities must maintain a register of change request logs and Statement of Architecture Work documents.
Business Intelligence and Analytics Domain
Entities must create a Business Intelligence and Analytics Plan with implementation roadmap, use case identification and prioritization through ideation workshops, and detailed use case specifications including objectives, analytics types, benefits, stakeholders, requirements, data sources, and technologies. For each approved use case, entities must develop an implementation plan covering functional and non-functional requirements, design, environments, development, testing, deployment timeline, personnel, and acceptance criteria; conduct training for all analytics employees on data gathering, model development, data models, visualization, and evaluation; and develop and implement awareness campaigns promoting reusable analytics assets, success stories, and new tools and workflows. Entities must define and conduct validation of use case outcomes addressing functional and non-functional requirements, personal data protection, and return on investment against targets; leverage a data analytics team of data scientists, data engineers, and visualization engineers; establish key performance indicators tracking use cases defined/piloted/implemented/scaled, total return on investment, and training and awareness sessions delivered; and document use cases, outcome reviews, and related process documentation in a register accessible to all stakeholders.
9.10 Data Value Realization Domain
Entities must declare and file a pricing request with the National Data Management Office for each data asset or product from which they plan to make money, including the asset description, pricing documentation, chosen charging model (subscription, consumption-based, freemium/premium, or one-time fee), proposed unit price, and cost recovery justification if applicable. Entities must also track how well their data monetization initiatives perform using specified metrics such as the number of products developed, revenue generated, and return on investment, and actively monitor implemented initiatives by measuring key performance indicators, managing change requests, and reporting problems.
9.11 Open Data Domain
Entities must create an open data plan with implementation roadmap and resource allocation, plan awareness campaigns on their open datasets' existence and benefits, and develop documented processes for identifying, publishing and maintaining public datasets in high quality while excluding restricted data. When identifying datasets, entities must assess risks of unauthorized personal information disclosure or security threats before deciding to publish. Entities must publish datasets under the KSA Open Data License, use standardized machine-readable formats (CSV, JSON, XML, RDF) with documented metadata and usage documentation, regularly update datasets with documented changes, measure KPIs (downloads per dataset, identified and prioritized datasets, published datasets, updates performed), and maintain a register of all open datasets with activity and decision logs.
9.12 Freedom of Information Domain
Entities must develop a Freedom of Information Plan aligned with National Data Management Office regulations, covering roadmap, resources, budget, and awareness initiatives to build transparency culture and train employees on information access obligations. Entities must design a standardized process for managing public information access requests following prescribed timeframes to grant access, deny, extend response period, or direct to website or competent authority. Entities must publish on government websites laws, regulations, services, organizational structure, job openings (except security roles), annual reports, activity statistics, contact details for licensed persons, and project information affecting public safety, along with awareness materials, or provide justification if inapplicable.
9.13 Data Classification Domain
Entities must create a Data Classification Plan with a roadmap, resources and budget, prioritize datasets and artifacts, identify and inventory all datasets and artifacts they own, assess potential damages from unauthorized access by impact level (High, Medium, Low, or None/Insignificant) and assign classification levels accordingly (Top Secret, Secret, Confidential, or Public), assess whether Low impact data can be classified as Public if disclosure does not breach regulations and benefits outweigh negative impacts, establish key performance indicators tracking percentage of datasets and artifacts classified overall and by level, percentage of Low impact data classified as Confidential, and percentage of classified datasets and artifacts reviewed and approved, and maintain a register documenting all identified datasets and artifacts with classification levels, assignment dates, classification duration, approved levels and review dates.
9.14 Personal Data Protection Domain
Entities must assess their personal data environment, create a protection plan with resources and budget, and train all employees on data protection, breach notification and data subject rights. Data controllers or processors must notify the regulatory authority within 72 hours of a compromise and establish documented breach management procedures, privacy notice and consent processes, and provide data subjects with access to hyperlinks on their internet presence and notices to the National Data Management Office on inspection request. Data subjects have rights to be informed, access, rectification, erasure, objection, restriction and portability; entities must inform them of these rights and provide submission, response and tracking means, conduct yearly risk assessments and internal audits with documentation and reporting to the Data Protection Officer, and notify authorities of non-compliance with corrective actions.
9.15 Data Security and Protection Domain
The National Cybersecurity Authority is responsible for detailed data security and protection controls covering information security governance, architecture, systems design and testing, identity and access management, third-party supplier security, security training, information asset management, operations management, incident management, risk management, and systems continuity. The framework provides an overview of these controls; compliance is conducted by the National Cybersecurity Authority using its own requirements and methodology, not as part of the National Data Management Office's compliance assessment.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 14 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 3 of 4
- Prohibited practices, not covered
Data and privacy 2 of 4
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 3 of 4
- Labelling of synthetic content, not covered
Technical safeguards 2 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
Assurance and lifecycle 1 of 4
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
2 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
Public sector organizations should implement the standards across fifteen data management and personal data protection domains.
- ObligationApplies to: Public authorityDrafted by the Index
Government entities should measure compliance yearly to track progress toward successful standards implementation.
3 2 controls
- ObligationApplies to: OthersDrafted by the Index
Business partners handling government data should understand and apply the standards to all government data in their control and custody.
- ObligationApplies to: Public authorityDrafted by the Index
The standards apply to government data in all recorded forms including paper records, emails, electronic files, voice recordings, videos, photos and other formats.
4 6 controls
- ObligationApplies to: DeployerDrafted by the Index
Each government entity must conduct a compliance audit yearly and send the report to the National Data Management Office by the third quarter.
- ObligationApplies to: Public authorityDrafted by the Index
The National Data Management Office must review and consolidate all submitted reports and publish annual compliance results across entity, sector and government levels to stakeholders.
- ObligationApplies to: DeployerDrafted by the Index
Entities must assign either 100% or 0% to each specification based on whether it is fully or only partially or not implemented, and roll these scores up through controls, domains and the overall entity level.
- ObligationApplies to: DeployerDrafted by the Index
Compliance reports must be accompanied by evidence showing how each applicable specification has been implemented.
- ObligationApplies to: DeployerDrafted by the Index
The Chief Data Officer must oversee and lead the compliance assessment process, with support from other data management and protection office roles.
- Applies to: Public authorityDrafted by the Index
The National Data Management Office may carry out unplanned compliance audits on specific entities to check and confirm the accuracy of their reported findings.
8 4 controls
- ObligationApplies to: AnyoneDrafted by the Index
All adopting entities must implement Priority 1 specifications as foundational building blocks during the first year after the standards release.
- ObligationApplies to: AnyoneDrafted by the Index
All adopting entities should implement Priority 2 specifications to improve data management capabilities during the second year after the standards release.
- ObligationApplies to: AnyoneDrafted by the Index
All adopting entities should implement Priority 3 specifications to further advance data management maturity during the third year after the standards release.
- ObligationApplies to: AnyoneDrafted by the Index
Each adopting entity must develop a three-year phased implementation plan with milestones at the end of each year to achieve full compliance with all specifications.
Data Governance Domain 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities must develop a three to five year data management and protection strategy that describes current challenges, business and national requirements, vision, goals, performance metrics with targets and required financial budgets.
- ObligationApplies to: DeployerDrafted by the Index
Entities must adopt the national data management and protection program's guiding principles to ensure their strategy aligns with national agendas, and may add entity-level principles that supplement the core national principles.
- ObligationApplies to: DeployerDrafted by the Index
Entities must formally adopt the national guiding principles either in their data management and protection strategy document or in a separate document.
- ObligationApplies to: DeployerDrafted by the Index
Entities must develop a data management and protection plan with a three year implementation roadmap based on their defined strategy.
Data Catalog and Metadata Domain 5 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities must create a Data Catalog Plan that includes a roadmap with activities and milestones to implement the automated Data Catalog tool, and must assign necessary resources and budget.
- ObligationApplies to: DeployerDrafted by the Index
Entities must rank data sources to be featured in the Data Catalog and define their business and technical metadata and structure.
- ObligationApplies to: DeployerDrafted by the Index
Entities must develop and document a target metadata architecture identifying metadata sources, the Data Catalog as central metadata repository, metadata flows between sources and repository, and the metadata model used.
- ObligationApplies to: DeployerDrafted by the Index
Entities must establish and follow a documented process for approving connections between the Data Catalog tool and the entity's data sources.
- ObligationApplies to: DeployerDrafted by the Index
Entities must establish and follow a documented process for granting employees access to the Data Catalog automated tool using role-based access controls.
Data Quality Domain 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
Organizations should identify and rank their data by importance for data quality management purposes, with priority data including the entity's master data.
- ObligationApplies to: Public authorityDrafted by the Index
Organizations should develop a data quality plan that includes an implementation roadmap with key milestones and allocation of required resources and budget.
- ObligationApplies to: Public authorityDrafted by the Index
Organizations should conduct an initial data quality assessment covering collection of business requirements, definition of quality rules, data profiling, issue reporting, and development of remediation plans including root cause analysis and resolution options.
Data Operations Domain 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities should create a data operations plan that includes a roadmap with implementation activities and milestones, and assign resources and budgets for data operations initiatives.
- ObligationApplies to: DeployerDrafted by the Index
Entities should periodically forecast storage capacity needed to support future business needs based on historical trends, application performance assessment and application development plans.
- ObligationApplies to: DeployerDrafted by the Index
Entities should rank their information systems by business criticality and potential impact from emergency or disaster to establish recovery order in the disaster recovery plan.
- ObligationApplies to: DeployerDrafted by the Index
Entities should establish and follow a documented process to evaluate and select database management system software considering cost of ownership, resource availability, market tools and scalability.
Data Architecture and Modeling Domain 2 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities should create a data architecture and modeling plan with a roadmap of implementation activities and milestones, and assign resources and budget for achieving target architecture capabilities.
- ObligationApplies to: DeployerDrafted by the Index
Entities should define both their current and target state data architecture and perform gap analysis between them.
Data Sharing and Interoperability Domain 3 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities should conduct an initial data integration assessment that inventories IT components, documents data lineage including transformation rules and change frequency, and records data models to identify pain points in data movement and integration.
- ObligationApplies to: DeployerDrafted by the Index
Entities should develop a target data integration architecture that addresses identified pain points and includes integration requirements, an architecture diagram of target components, and a list of IT components in scope.
- ObligationApplies to: DeployerDrafted by the Index
Entities should create a data integration plan with a roadmap, key milestones and implementation activities for the target data integration architecture.
Reference and Master Data Management Domain 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities should create a reference and master data plan with a roadmap for implementation activities and milestones, and assign resources and budget for achieving target reference and master data management capabilities.
- ObligationApplies to: DeployerDrafted by the Index
Entities should identify and list their master data objects used across the entity, identify reference data objects required by master data objects, and identify data sources and applications where these objects are created, updated or deleted.
- ObligationApplies to: DeployerDrafted by the Index
Entities should logically group and prioritize their identified reference and master data objects to determine a phased implementation approach.
- ObligationApplies to: DeployerDrafted by the Index
Entities should classify each reference data object as internally owned and managed by the entity, or externally owned and managed by other government entities or industry standard organizations.
Business Intelligence and Analytics Domain 3 controls
- ObligationApplies to: DeployerDrafted by the Index
Entities should create a business intelligence and analytics plan that includes implementation roadmap with milestones and resource allocation.
Change history
No changes recorded since we began monitoring this policy.