Version 1.5 (document control June 2021). Mandatory for government entities.
Last verified
2026-10-20
NDMO Data Management and Personal Data Protection Standards. The hosted text appears to be version 1.5 (document control June 2021). Mandatory for government entities.
77 controls and 191 specifications. The Data Security and Protection domain is left to the National Cybersecurity Authority (NCA), so the controls appear to sit in the other 14 domains.
Breach handling: read the Personal Data Protection domain with Implementing Regulation (IR) Art 24, which requires notice to SDAIA within 72 hours where an incident may cause harm. SDAIA's October 2026 draft would remove that harm threshold for notifying SDAIA.
Key provisions
PDP.1: Plan. Personal Data Protection domain, control PDP.1, and the PDP plan. NDMO DM & PDP Standards: 15 domains → 77 controls → 191 specifications; codes are PDP.x (control) / PDP.x.x (specification), e.g. PDP.1.1. (No 'CS'/'MQ' infix exists.)
PDP.2: Training and Awareness. Personal Data Protection domain, control PDP.2, training and awareness.
PDP.3: Data Breach. Personal Data Protection domain, control PDP.3, data-breach detection, logging and notification to the regulator.
PDP.4: Data Lifecycle Management. Personal Data Protection domain, control PDP.4, data lifecycle management; its specifications include risk-assessment findings (PDP.4.3) and monitoring (PDP.4.4).
PDP.5: Artifacts. Personal Data Protection domain, control PDP.5, artifacts (records and registers).