A Data Management Office with a mandate
A permanent team led by the Chief Data Officer (CDO). It owns the policies, runs the compliance cycle and supports data owners across the business.
Data governance services
Make data governance operational.
Limaz builds the ownership, decision rights, inventories, rules, workflows, and technical connections that turn data governance into daily work.
What changes
- Know which data matters, where it lives, who owns it, and how it may be used.
- Give data owners, stewards, technology teams, privacy, and security clear decision rights.
- Apply classification, quality, retention, sharing, and lifecycle rules in real workflows.
- Connect governance decisions to catalogs, access controls, DLP, integrations, and evidence.
- Handle exceptions, issues, and changes through an accountable operating cadence.
- Support PDPL and regulatory obligations without reducing governance to a compliance checklist.
What Limaz delivers
- Governance operating model
- Decision rights, forums, escalation, issue management, and recurring responsibilities.
- Data inventory and ownership
- Critical data domains, systems, flows, owners, stewards, and accountable custodians.
- Governance rules
- Classification, quality, access, sharing, retention, deletion, and acceptable-use decisions.
- Workflow implementation
- Requests, approvals, exceptions, quality issues, privacy assessments, and evidence collection.
- Catalog and tooling integration
- Connect the operating model to selected catalog, DLP, IAM, workflow, and reporting tools.
- Measures and reporting
- Useful measures for ownership, quality, control operation, unresolved issues, and risk.
- PDPL connection
- Processing records, rights, DPIA, vendors, and lifecycle controls connected to the dedicated PDPL program.
- Training and handover
- Role-specific routines so governance continues after implementation.
How to implement data governance
Start with the decisions and data that matter, then connect policy to daily work and technology.
Prioritize
Choose the data domains, business outcomes, and regulatory needs that justify the first scope.
Assign ownership
Name accountable owners, stewards, custodians, and decision forums.
Inventory
Map critical data, systems, flows, quality needs, and existing controls.
Set the rules
Define classification, access, sharing, quality, retention, and exception decisions.
Embed
Put approvals, issue handling, controls, and evidence into selected workflows and tools.
Measure
Review ownership, quality, risk, exceptions, and control operation on a recurring cadence.
The NDMO standards and how they relate to PDPL
The National Data Management Office (NDMO), part of the Saudi Data and AI Authority (SDAIA), sets the national rules for how data is governed. Its core technical document is the Data Management and Personal Data Protection Standards, version 1.5, published in January 2021.
The standards define 15 domains, 77 controls and 191 specifications. Every specification carries a priority: P1 for the first year, P2 for the second year and P3 from the third year onward. They build on the National Data Governance Interim Regulations published in 2020, which contain the national policies for data classification, data sharing, open data, freedom of information and personal data protection.
They apply to all public entities in the Kingdom, including ministries, authorities and their affiliates, and to private companies that handle government data as business partners. A bank, fintech or technology vendor that processes government data for a public entity is covered for that data.
The Personal Data Protection Law (PDPL) is broader. It binds every organization that processes personal data in the Kingdom, and organizations abroad that process personal data of people living in it. It came into force on 14 September 2023, and the grace period ended on 14 September 2024. SDAIA supervises both.
In practice, one governance program serves both. The inventories, owners, classification and lifecycle rules the NDMO standards require are the same foundations PDPL compliance runs on. Build them once and connect them to both sets of obligations.
The 15 NDMO data management domains
- 1. Data Governance
- Strategy, policies, the Data Management Office, named roles, decision forums and the annual compliance cycle. Every other domain depends on it.
- 2. Data Catalog and Metadata
- A catalog of data assets with business and technical metadata, so people can find data, understand it and see who owns it.
- 3. Data Quality
- Quality rules for critical data, measured on a schedule, with issues logged, assigned to an owner and fixed at the source.
- 4. Data Operations
- Storage, backup, recovery and retention of data, run to documented procedures with clear operational owners.
- 5. Document and Content Management
- Rules for documents and unstructured content: creation, versioning, retention, archiving and disposal.
- 6. Data Architecture and Modeling
- A target data architecture, data models and design standards that keep new systems consistent with the rest of the entity.
- 7. Data Sharing and Interoperability
- Governed data sharing between entities: requests, agreements, approvals and integration standards, in line with the national Data Sharing Policy.
- 8. Reference and Master Data Management
- One trusted version of core records such as customers, products and locations, with owners and change control.
- 9. Business Intelligence and Analytics
- Governed reporting and analytics: approved sources, defined metrics and controlled access to analytical data.
- 10. Data Value Realization
- A plan to create value from data through better services, efficiency or revenue, with each use case tracked.
- 11. Open Data
- Identifying datasets that can be published as open data, preparing them and publishing them on a schedule.
- 12. Freedom of Information
- Handling public requests for access to government information through defined procedures and timelines.
- 13. Data Classification
- Classifying data as Top Secret, Secret, Restricted or Public based on impact, and keeping a classification register.
- 14. Personal Data Protection
- Privacy obligations for personal data: notices, consent, data subject rights, breach handling and records. These now sit alongside PDPL obligations.
- 15. Data Security and Protection
- Covered by the National Cybersecurity Authority (NCA) controls, such as the Essential Cybersecurity Controls (ECC), instead of separate NDMO specifications.
What an operational data governance program looks like
Policies are the start. An operational program shows in how the entity decides, records and fixes things every week.
A committee that decides
A data governance committee of business and technology leaders. It approves policies, settles ownership disputes, accepts risk and signs off exceptions, with minutes that prove it.
Registers that stay current
Data asset inventory, catalog, classification register, processing records and sharing agreements, each with an owner and a review date.
Rules built into workflows
Access requests check the classification. New systems pass an architecture and privacy review. Data sharing runs through an approval flow instead of email.
Measures on a fixed cadence
Ownership coverage, quality scores, open issues, overdue reviews and specification compliance, reported to the committee every quarter.
Evidence as a by-product
Approvals, reviews and decisions leave records in the tools where the work happens, so the annual assessment becomes a collection exercise.
Roles: data owners, stewards and custodians
- Chief Data Officer (CDO)
- Leads the data management program, reports to the governance committee and owns the entity's compliance with the NDMO standards.
- Data Management Office
- Runs policies, registers, training and the compliance assessment day to day, and coordinates the other roles.
- Data owner (Business Data Executive)
- A senior business leader accountable for a data domain. Approves classification, access, sharing and quality targets for that data.
- Business Data Steward
- Works inside the business unit. Defines terms and quality rules, reviews access requests and raises data issues.
- IT Data Steward (custodian)
- Runs the systems that hold the data. Applies the controls the owner approved: access, backup, retention, encryption and deletion.
- Data Protection Officer
- Oversees privacy obligations, data subject requests, impact assessments and breach handling, and links the program to PDPL.
- Compliance Officer
- Tests whether controls operate and prepares evidence for the annual assessment.
- Open Data and Information Access Officer
- Manages open data publication and freedom of information requests.
Evidence and compliance assessment
Entities assess their compliance with the NDMO standards every year, and the CDO leads the assessment. Each specification is scored pass or fail, and the scores roll up to control, domain and entity level.
A pass needs evidence. Assessors look for approved documents, such as the data management strategy and policies, and for proof that those documents operate: committee minutes, populated registers, quality reports, completed access reviews, signed sharing agreements and training records.
For government entities, SDAIA also runs the National Data Index (NDI), launched in November 2023. It combines a data management maturity questionnaire, a compliance assessment against the national data management controls and an assessment of operational indicators. A strong NDI result needs both documents and working operations.
The practical rule: if evidence has to be produced in the weeks before the assessment, the control is weak. Build evidence capture into the workflows from the first day.
Common gaps
- Policies approved and then ignored: staff outside the Data Management Office cannot name the rule that applies to their data.
- Owners on paper only: a name in a register, with nobody approving access, classification or quality targets.
- Inventories built once for a project and never updated as systems change.
- Classification applied to documents only, while databases, data warehouses and SaaS exports stay unclassified.
- Data sharing approved by email, with no agreement, purpose or expiry on record.
- Privacy and governance run as separate programs with separate inventories that disagree.
- Quality issues fixed downstream in reports instead of at the source system.
- Evidence gathered by hand at assessment time, so scores reflect that month's effort instead of real operation.
How Limaz delivers
Delivery follows the NDMO priorities and your PDPL obligations, so each phase leaves something that runs.
Baseline
Assess current practice against the NDMO specifications and PDPL obligations that apply to you. Score each one, list the evidence gaps and rank them by priority.
Operating model
Set up the Data Management Office, the governance committee, role descriptions and a responsibility matrix for each data domain.
P1 foundations
Write and approve the strategy and core policies in Arabic and English, then build the first registers: data assets, classification, processing records and sharing.
Workflows and tooling
Connect the rules to the catalog, access management, data loss prevention (DLP), ticketing and reporting tools you use or select.
Evidence and self-assessment
Map every specification to its evidence source, run a mock assessment and close the gaps before the formal cycle.
Run and mature
Hand routines to named owners, then move through the P2 and P3 specifications with quarterly measures and committee reviews.
Questions
They are the national data governance standards issued by the National Data Management Office (NDMO) at the Saudi Data and AI Authority (SDAIA). Version 1.5, published in January 2021, sets 77 controls and 191 specifications across 15 domains, from data governance and data quality to classification and personal data protection. Each specification has a priority (P1, P2 or P3) that sets the order of implementation over three years.
All public entities in Saudi Arabia, including ministries, authorities, public agencies and their affiliates. The standards also cover private companies that handle government data as business partners, such as vendors, service providers and financial institutions processing data for a government entity. Other private organizations are bound by PDPL for personal data, and the NDMO standards give them a proven structure for their own governance program.
PDPL is a law. It applies to anyone processing personal data in the Kingdom, SDAIA enforces it, and fines reach SAR 5 million, doubled for repeat violations. The NDMO standards are a governance framework for public entities and their partners. They cover all government data, including quality, catalog, sharing, classification and open data, with personal data protection as one of 15 domains. One program built on shared inventories and owners serves both.
Fifteen: Data Governance; Data Catalog and Metadata; Data Quality; Data Operations; Document and Content Management; Data Architecture and Modeling; Data Sharing and Interoperability; Reference and Master Data Management; Business Intelligence and Analytics; Data Value Realization; Open Data; Freedom of Information; Data Classification; Personal Data Protection; and Data Security and Protection. The last domain is governed by the National Cybersecurity Authority controls, so NDMO sets no separate specifications for it.
Entities run a compliance assessment every year, led by the Chief Data Officer. Each specification is scored pass or fail, backed by evidence such as approved policies, committee minutes, populated registers and review records. Scores roll up to control, domain and entity level. Government entities are also measured through the National Data Index (NDI), which adds a maturity questionnaire and operational indicators to the compliance assessment.
The National Data Index is SDAIA's index for tracking how government entities manage data. Launched in November 2023, it combines three assessments: a data management maturity questionnaire, a compliance assessment against the national data management controls, and an assessment of operational indicators. It gives each entity a measured position and shows where its data management needs work.
The standards set a three-year path. P1 specifications, the foundational controls, come in the first year. P2 specifications follow in the second year, and P3 specifications from the third year onward. Limaz plans delivery against the same priorities, so the P1 foundations and their evidence are ready first and each later phase builds maturity on top of them.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.