Data classification
Define and enforce data classification rules.
Limaz builds classification levels, ownership, handling rules, labeling processes, and the technical connections that make classification usable in operations.
What gets implemented
- Classification levels
- A usable scheme matched to the organization's data and risk.
- Ownership
- Who classifies, who approves, and who handles exceptions.
- Handling matrix
- Access, storage, sharing, transfer, retention, and destruction by level.
- Labeling process
- How classification is applied in documents, systems, and exchanges.
- Tooling and DLP
- Labels connected to technical controls and DLP.
- Training
- So classification is practiced, not laminated.
- Validation
- Check whether classification is designed, applied, and still operating.
Arabic operating need
Many Saudi teams need تصنيف البيانات and سياسة تصنيف البيانات in Arabic so handling rules can be used by operations, not only by a policy author.
Limaz delivers the policy and handling rules in Arabic and English.
The national Data Classification Policy
Saudi Arabia has one national scheme for classifying data. The National Data Management Office (NDMO) at the Saudi Data and AI Authority (SDAIA) issued the Data Classification Policy in 2020, as part of the national data governance policies. It defines four levels: Top Secret, Secret, Restricted and Public.
The policy applies to all public entities and to private companies that handle government data. It is also Data Classification, domain 13 of the NDMO Data Management and Personal Data Protection Standards, so public entities are assessed on it in their annual compliance cycle.
The level depends on impact: the harm that would follow if the data were disclosed, accessed without authorization or tampered with. The assessment covers four areas: the national interest, the activities of organizations, the interests of individuals, including their privacy and safety, and the environment.
A set of principles guides every decision. Data is open by default unless its nature requires protection. Classification must be necessary and proportionate, and done on time, when data is created or received. Data that combines levels takes the highest one. Duties are segregated, and access follows need-to-know and least privilege.
The four classification levels
- Top Secret (high impact)
- Unauthorized disclosure, access or tampering causes severe, exceptional harm that cannot be repaired, for example to national security, sovereignty, critical infrastructure or public health.
- Secret (medium impact)
- Unauthorized disclosure, access or tampering causes significant harm, for example to national interests, an organization's finances or operations, or the safety of a group of people.
- Restricted (low impact)
- Unauthorized disclosure causes limited negative impact on an organization's operations, limited financial loss or limited harm to individuals or the environment.
- Public (no impact)
- Disclosure causes none of the impacts above. The data can be shared openly and is a candidate for open data publication.
How to classify data
The national policy sets a seven-step process. Here is what each step means in practice.
Identify the data
List the data assets the organization holds: databases, applications, file shares, documents, SaaS platforms and data received from other parties.
Assign responsibility
Name who classifies each asset. The data owner decides, and business stewards prepare the assessment.
Assess the impact
For each asset, decide which areas an unauthorized disclosure would affect and how badly: high, medium, low or none. The highest result sets the level.
Check low-impact data against regulation
If the impact is low, check whether a law or regulation restricts disclosure, such as PDPL for personal data. If one does, classify the data as Restricted.
Weigh benefit against harm
If no regulation restricts it, compare the benefit of making the data available with the negative impact of disclosing it. If the benefit is greater, the data is Public.
Review the result
Check the classification for completeness and accuracy, approve it and record it in the classification register with the date and a review date.
Apply the controls
Apply the handling and security controls for the level: labels, access rights, encryption, sharing rules, retention and disposal.
Handling rules per level
- Top Secret
- Named individuals only, approved one by one. Stored in approved, segregated environments with encryption at rest and in transit. No personal devices or external email. Printing and copying logged, and destruction witnessed and recorded.
- Secret
- Access by role, approved by the owner and reviewed on a schedule. Encrypted at rest and in transit. Shared outside the organization only under a signed agreement. DLP blocks transfer to unapproved destinations. Disposal recorded.
- Restricted
- Access for staff who need the data for their work. Encrypted in transit. Internal sharing allowed, external sharing approved by the owner. Labelled in documents and systems.
- Public
- Open access, with integrity protected: publish from an approved source, track versions and control who can change the data.
- Not yet classified
- Handle as Restricted until the owner completes the assessment. New data stays protected, and work continues.
- Combined datasets
- A dataset, report or extract that mixes levels takes the highest level of its contents, including analytics extracts and AI training sets.
Labelling and DLP
A classification that lives only in a register protects nothing. The level has to travel with the data, as a label people can see and as metadata systems can read.
Visible labels go in document headers and footers, email subjects and report cover pages. Metadata labels sit on files, database tables and columns, and data catalog entries. The two must match, and the label is set when the data is created or received.
Data loss prevention (DLP) then acts on the label. Rules block Secret data from leaving to personal email or unapproved cloud storage, warn users who share Restricted files externally, and log every attempt for review. Identity and access management (IAM) uses the same label to grant rights by level.
Discovery tools scan repositories and suggest a level based on content, such as national ID numbers, account numbers or health records. The data owner confirms the level. This combination classifies large volumes quickly and keeps accountability with a named person.
How classification links to NCA ECC and PDPL
The National Cybersecurity Authority (NCA) sets the security controls that protect classified data. Its Essential Cybersecurity Controls, ECC-2:2024, require organizations to define, implement and periodically review cybersecurity requirements for protecting and handling data and information, in line with the related laws and regulations. This is subdomain 2-7, Data and Information Protection.
ECC control 2-7-3 requires those requirements to include the applicable controls from the NCA Data Cybersecurity Controls, DCC-1:2022. DCC applies to government organizations, their affiliated companies and private operators of critical national infrastructure. Its 19 controls and 47 subcontrols change with the classification level, so the level set under the NDMO policy decides which security controls apply.
The Personal Data Protection Law (PDPL) governs personal data wherever it sits, and it sets no classification levels of its own. Harm to individuals, including their privacy, is one of the four areas in the impact assessment. Personal data is therefore classified by the harm its exposure would cause, and that level drives the controls that meet PDPL's security and breach notification duties.
Common gaps
- A policy with four levels, but no register showing which assets sit at which level.
- Everything marked Secret by default, which blocks sharing and trains staff to ignore labels.
- Impact assessments skipped: levels chosen by instinct, with no record of the reasoning.
- Documents labelled, while databases, data warehouses, backups and analytics extracts carry no classification.
- Labels that no system reads, so DLP and access rules run on separate lists.
- No review dates, so classifications stay fixed after the data gains or loses sensitivity.
- Reports and combined datasets classified lower than the most sensitive data inside them.
- Handling rules written for IT alone, with no guidance for staff who print, email or share data.
Questions
The national Data Classification Policy issued by the National Data Management Office (NDMO) at SDAIA sets four levels. Top Secret covers data whose exposure causes severe, exceptional harm (high impact). Secret covers significant harm (medium impact). Restricted covers limited harm (low impact). Public covers data whose disclosure causes no harm. The level is set by an impact assessment across the national interest, organizations, individuals and the environment.
All public entities in the Kingdom, including ministries, authorities and their affiliates, and private companies that handle government data as business partners. The policy is also domain 13 of the NDMO Data Management and Personal Data Protection Standards, so public entities are assessed on it every year. Government organizations and critical national infrastructure operators must also apply the NCA Data Cybersecurity Controls to data at each classification level.
Run an impact assessment. Ask what harm unauthorized disclosure, access or tampering would cause to the national interest, organizations, individuals and the environment, and rate it high, medium, low or none. High impact means Top Secret, medium means Secret and low means Restricted. With no impact, the data is Public. Low-impact data is also checked against laws such as PDPL, and the highest rating across the four areas wins.
The difference is the size of the harm. Secret data would cause significant harm if exposed, such as serious financial loss to an organization or danger to a group of people. Restricted data would cause limited harm, such as a limited effect on operations or limited financial loss. Secret data needs tighter controls: role-based access approved by the owner, encryption at rest and in transit, and sharing only under a signed agreement.
The Essential Cybersecurity Controls (ECC-2:2024) from the National Cybersecurity Authority require organizations to define, implement and review requirements for protecting data and information, in subdomain 2-7. Control 2-7-3 requires those requirements to include the applicable NCA Data Cybersecurity Controls (DCC-1:2022), which vary by classification level. So the classification level decides which ECC and DCC data protection controls an organization applies.
The Personal Data Protection Law (PDPL) governs how personal data is collected, used, shared and protected, and the national classification policy supplies the levels. Harm to individuals, including their privacy, is one of the four impact areas, so personal data is classified by the harm its exposure would cause. The resulting level drives access, encryption, sharing and retention controls, which support PDPL's security and breach notification duties.
Under the NDMO standards, the register lists every identified data asset, the classification level assigned to it, the date of assignment, how long the classification is valid, the level approved after review and the date of that review. A useful register also names the data owner and links each asset to the systems that hold it, so labels, DLP rules and access controls can be traced back to an approved decision.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.