Saudi Data & Artificial Intelligence Authority / National Data Management Office

NDMO Data Governance and Management Services in Saudi Arabia

Build an operational NDMO data governance program with clear ownership, data catalogs, quality controls and evidence across Saudi government data environments.

Discuss your readiness اقرأ هذه الصفحة بالعربية

Data Management and Personal Data Protection Standards; confirm applicable editionSources reviewed: 4 November 2026

Understand the requirement. Connect it to operations.

The National Data Management Office sits within SDAIA and establishes national data management and governance policies, standards and controls. Its Data Management and Personal Data Protection Standards organize requirements across fifteen domains. This breadth matters: data governance includes ownership, quality, metadata, architecture and lifecycle decisions, alongside protection. A security product alone cannot deliver an operating data management program.

IRIS Technology can support Saudi organizations in translating the applicable NDMO requirements into responsibilities, workflows and technical capabilities. The work begins with an agreed scope and a practical gap assessment, then connects governance decisions to catalogs, integrations, platforms and reporting. Each improvement should identify the accountable owner, operational evidence and a realistic delivery sequence. Existing policies and technology should be assessed before adding another tool or creating parallel documentation.

Confirm applicability before choosing controls.

The standards address public entities and extend to business partners handling government data. Confirm the organization's status, the data in its custody, contractual commitments and relevant authority directions. Do not assume every Saudi private business has identical obligations under the complete framework. Where personal data is processed, assess PDPL and its implementing requirements separately and coordinate the resulting actions.

The published Version 1.5 document, dated January 2021, provides an official reference; validate the applicable edition and assessment instructions when setting the engagement baseline. Establish boundaries across departments, outsourced operations, source systems, reporting platforms and archives. Include paper and digital records where relevant. The implementation roadmap should distinguish policy approval, process adoption, platform configuration and demonstrated operation rather than treating a signed document as completion.

Turn requirements into implementation and evidence.

Practical examples, not an exhaustive assessment or mandatory product list
Focus area	Implementation examples	Evidence to maintain
Data office and accountability	Define owners, stewards, decision rights and escalation routes.	Approved operating model, role assignments and governance meeting records.
Inventory and metadata	Identify priority datasets, definitions, sources and transformations.	Maintained catalog, ownership records and traceable data flows.
Quality management	Agree business rules and remediation ownership for important data.	Quality measurements, issue register and verified corrective actions.
Lifecycle and architecture	Connect collection, integration, retention and disposal decisions.	Architecture views, approved schedules and lifecycle execution records.
Program assurance	Track applicable requirements, delivery dependencies and operational adoption.	Evidence register, management reporting and reviewed improvement roadmap.

What this looks like in practice.

An inconsistent customer record

Finance and service teams may use different identifiers for the same customer. Agree the authoritative source, business definition and correction workflow before implementing synchronization or dashboards.

A government-data service partner

A partner should identify the government datasets it handles, permitted uses, access boundaries and disposal responsibilities. Translate commitments into operating controls and evidence that the customer can review.

From readiness assessment to working controls.

Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.

Assess and prioritize

Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.

Design the improvements

Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.

Implement and validate

Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.

Handover and sustain

Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.

Agree concrete deliverables.

A scope and applicability record with assumptions and responsibilities.
A gap/risk register and prioritized remediation roadmap.
Control mapping, architecture recommendations and operating procedures.
An evidence register, agreed validation results and handover material.

Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.

Common questions.

Is NDMO the same as PDPL?

No. NDMO data management standards address a broader management program. PDPL regulates personal data processing. Map their intersections while retaining the specific scope and requirements of each.

Does a data catalog establish readiness?

A catalog supports discovery and metadata. Owners still need to maintain definitions, resolve quality issues, govern use and demonstrate that approved processes operate.

Where should implementation start?

Start with high-value datasets and known risks. Validate ownership and current evidence, then prioritize achievable improvements with dependencies, resources and measurable outcomes.

Can existing tools support the program?

Often yes. Review capabilities and integration before procurement. The useful question is whether the existing estate can sustain required workflows and reliable evidence.

What can IRIS deliver?

An agreed assessment, data governance operating model, prioritized implementation roadmap and supporting technical integration. Deliverables depend on the actual scope; regulatory decisions remain with the responsible authority.

Start with the official sources.

Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.

General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.

Related frameworks and requirements

Saudi Data Classification and Sharing →Saudi Open Data and Freedom of Information →Saudi PDPL →NCA DCC →SDAIA Responsible AI Governance →

Define the right scope for your organization.

Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.

Discuss your readiness