A collaboration folder
A team labels a folder but an external link remains broadly accessible. Review inherited permissions, link settings and download behavior, then test enforcement using representative users.
Saudi regulatory frameworks
Saudi Data & Artificial Intelligence Authority / National Data Management Office
Saudi Data Classification and Secure Sharing Services
Implement Saudi data classification and controlled sharing through discovery, labels, access rules, DLP, approvals and evidence aligned with applicable SDAIA requirements.
Data Classification and Data Sharing policies and regulationsSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
SDAIA publishes Data Classification Policy and Regulations and Data Sharing Policy and Regulations within its national data governance framework. Classification guides protection according to the consequences of inappropriate disclosure or handling. Official national policy material uses four levels: Top Secret, Secret, Restricted and Public. Applying a label is a starting decision; effective protection requires that systems and people handle the information consistently with that decision.
IRIS Technology can help connect business classification to discovery, identity, endpoint protection, information rights, data loss prevention and secure collaboration. The approach follows actual data flows across files, databases, email, APIs, cloud applications and supplier access. Each sharing route needs an owner, a permitted purpose, appropriate authorization and reviewable evidence. Policy design and technical enforcement should be implemented together so routine business activity can follow the approved process.
Confirm applicability before choosing controls.
The national classification framework concerns data received, produced or handled by public entities, while the sharing framework regulates government data shared with government entities, private entities and individuals. Determine the applicable responsibilities for each participating organization, including contractual requirements for service partners. Review the current official policies and implementation regulations before approving handling rules or adopting an inherited classification scheme.
Confidentiality classification and personal data status answer different questions. Information can identify an individual without being assigned the highest confidentiality level; sensitive personal data has a specific meaning under PDPL and should not be confused with a security label. A classification decision does not create a lawful basis for processing or authorize disclosure. Coordinate classification, PDPL, applicable NCA data controls and sector restrictions for the actual dataset and proposed sharing activity.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Discovery and ownership | Find priority data stores and assign classification decisions to owners. | Discovery coverage, dataset owners and unresolved classification decisions. |
| Classification and handling | Translate impact assessments into labels and handling instructions. | Approved classification register, label mappings and exception approvals. |
| Access and enforcement | Align permissions, encryption and DLP with approved use. | Access reviews, configuration checks and validated policy tests. |
| Sharing governance | Define purpose, recipients, approvals and required agreements. | Request records, approved sharing terms and transfer audit trails. |
| Ongoing assurance | Review changes, incidents, recipient access and obsolete copies. | Periodic reviews, revocation records and corrective action tracking. |
What this looks like in practice.
An API data exchange
Before integration, confirm which fields are needed, who receives them and how usage is controlled. Record approval, authentication, logging, retention and the process for withdrawing access.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Are personal data and confidential data identical?
No. Personal data concerns identifiability; classification concerns protection and impact. Sensitive personal data is a defined PDPL category. Assess each dimension explicitly instead of translating one label into another.
Does Public classification allow every use?
No. Validate publication eligibility, personal data obligations, intellectual property and other restrictions. A label does not remove requirements governing processing or onward use.
Can a DLP product classify everything automatically?
Automation can identify patterns and recommend labels. Business context, impact, ownership and approved exceptions still require human decisions and ongoing review.
Must all sharing use the same approval?
Approval and agreement requirements depend on the applicable policy, classification, parties and circumstances. Build a controlled workflow based on the current official text.
What makes implementation measurable?
Measure discovered coverage, ownership, tested handling behavior, sharing approvals and closure of exceptions. Tool deployment alone does not prove that confidential information follows the intended route.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness