Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Data Management & Governance › Data Classification Policy

Data Classification Policy

Type	Instrument
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Data Management & Governance
Tier	Implementing & executive regulation
Legal status	In force
Instrument number	NDMO (SDAIA)
Issued	2020-05-05
Version	1
Dates	Policy, part of the National Data Governance Policies (v1, 5 May 2020).
Last verified	2026-10-20

NDMO Data Classification Policy, part of the National Data Governance Policies (v1, 5 May 2020). It applies to all data received, produced or managed by public entities, in any form.

• Four levels: Top Secret, Secret, Restricted (categories A, B and C) and Public.
• Proposed: SDAIA's draft amendments to the PDPL Implementing Regulation (IR) (consultation 6 October to 5 November 2026) add Art 23(2): 'The Controller shall store Personal Data within the Kingdom', with transfers still permitted under the Law. If adopted, this would sit beside the classification-based hosting rules for government data, apply to personal data in shared, secondary-use and monetised data products, and make any transfer abroad a registration trigger.

Documents

• Hosted official text (PDF, English)
• Official source (sdaia.gov.sa)

In this framework

• SDAIA Organizational Arrangements
• Data Sharing Policy
• NDMO Data Management & Personal Data Protection Standards
• Freedom of Information Policy
• National Data Governance Interim Regulations
• Open Data Policy
• Data Monetization Policy
• National Data Index (NDI)
• NDI: Operational Excellence (OE)
• General Rules for Secondary Use of Data
• NDI: Operational Excellence FAQs
• Data Regulatory Sandbox

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21