A statistical dataset
A department wants to publish a spreadsheet containing aggregate figures and hidden person-level sheets. Inspect the complete file, remove inappropriate content, verify metadata and approve the actual release artifact.
Saudi regulatory frameworks
Saudi Data & Artificial Intelligence Authority / National Data Management Office
Saudi Open Data and Freedom of Information Implementation
Build controlled open data publication and freedom of information workflows with dataset quality, eligibility reviews, redaction, approvals and traceable records.
Open Data and Freedom of Information policies and regulationsSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
Saudi national data governance distinguishes open data publication from freedom of information requests. SDAIA's official regulatory index lists separate policies and regulations for both. Open data is a subset of public information intended for accessible reuse, while freedom of information concerns requests for eligible public information held by public entities. These activities share governance foundations but need different operational workflows and measures.
IRIS Technology can support government-focused implementation through dataset inventories, publication pipelines, metadata management, quality checks and request handling tools. The objective is a repeatable service: staff can identify eligible information, obtain accountable approvals, publish or respond through the approved channel and preserve a reviewable record. Technology should reduce manual coordination while keeping disclosure decisions with the authorized owners. Published information also needs maintenance after the initial release.
Confirm applicability before choosing controls.
Confirm the public entity's applicable obligations, current national policies, implementing regulations and any specific directions. Open data work should begin with eligible datasets and an approved publication plan rather than exporting whatever happens to be available. An internal database, a public information record and a reusable open dataset are different objects; each requires an explicit decision about release and handling.
Publication and information access must account for personal data, confidentiality, intellectual property and other applicable exclusions. Classification helps identify protection needs but does not independently settle disclosure eligibility. Establish review and redaction arrangements with the relevant data, legal and security owners. Apply response periods, escalation rules and review procedures from the current official text rather than inventing one service deadline for every request or dataset.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Dataset planning | Identify candidate datasets, owners, users and publication priorities. | Approved open data plan and maintained dataset inventory. |
| Eligibility and protection | Review disclosure restrictions and perform appropriate redaction. | Release approvals, review records and validated published samples. |
| Quality and metadata | Check definitions, completeness, formats and descriptive information. | Quality results, metadata records and documented correction ownership. |
| Publication operations | Manage release channels, updates, availability and reuse terms. | Publication history, update schedule and maintenance records. |
| Information requests | Route requests through assessment, response and applicable review steps. | Request register, decision records and service performance reporting. |
What this looks like in practice.
A request spanning departments
One request may involve several information owners. Assign coordination and track the relevant records so the response is consistent, authorized and traceable without losing responsibility between teams.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Are open data and FOI the same?
No. Open data is proactive publication for reuse; FOI provides a request-based access process for eligible information. Coordinate their inventories and decisions while preserving distinct workflows.
Can every public record be published as open data?
No. Determine eligibility and restrictions, including personal data and protected information. Assess the actual content and proposed format before approving publication.
Is uploading a spreadsheet enough?
A sustainable program also needs ownership, quality, metadata, suitable formats, update arrangements and a way to correct errors. A forgotten upload quickly loses value.
How should request deadlines be configured?
Use the current applicable policy and regulations to define timing, notifications and escalation. Validate the rules before encoding them in a ticketing or workflow platform.
What can implementation produce?
A publication plan, release workflow, dataset quality checks and a controlled request register with operational reporting. Agree integrations, ownership and ongoing support as part of the scope.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
- SDAIA: Open data and freedom of information policies ↗
- Saudi National Portal: Open government data ↗
- Saudi National Portal: Freedom of information ↗
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness