Data Classification in Saudi Arabia: Levels, Labels, and Automation

Why classification is the gateway control

Data classification is the control that every other control depends on. Before an organization can decide who may access a dataset, where it may be stored, whether it can be shared with another entity, or when it must be destroyed, it first has to answer a simpler question: how sensitive is this data?

That is why classification sits at the heart of the NDMO framework. The National Data Management Office's framework spans 15 domains, 77 controls, and 191 specifications — and data classification is one of those domains, not as a paperwork exercise but as the prerequisite for protection, sharing, and lifecycle management.

The Personal Data Protection Law (PDPL) raises the stakes further. Fully enforced since September 2024 under SDAIA's authority, it carries penalties of up to SAR 5 million — and up to SAR 10 million for repeat violations. You cannot protect personal data you have not identified, and you cannot identify it reliably without a working classification program.

The four national classification levels

Saudi Arabia's national data classification policy defines four levels, each assigned according to the impact that unauthorized disclosure would cause:

• Top Secret (سري للغاية). Data whose disclosure would cause exceptional, grave damage to national interests — national security, the Kingdom's economy, foreign relations — or endanger people's lives and safety. Access is restricted to the narrowest possible circle.
• Secret (سري). Data whose disclosure would cause serious damage to national interests, to the activities of entities, or to the interests and privacy of individuals.
• Restricted (مقيد). Data whose disclosure would cause limited negative impact on an entity's operations or on individuals. Most internal operational data and routine personal data falls here.
• Public (عام). Data whose release causes no harm and which may be published without restriction.

How a level is chosen: impact assessment

The level is not chosen by intuition. It comes from a structured assessment of disclosure impact across defined dimensions: national interest, the entity's activities, reputation and finances, individuals' privacy and safety, and the environment. The highest applicable impact determines the level.

Classification has two opposite failure modes. Under-classification exposes sensitive data; over-classification blocks legitimate sharing and open-data initiatives. Good practice therefore mandates periodic review, with reclassification or declassification when the original justification no longer applies.

Labels must travel: how classification propagates

A classification label assigned to a table in a source system is only the beginning, because data does not stay in one place:

• ETL pipelines copy it into staging environments and data warehouses.
• Dashboards and reports aggregate and re-present it.
• CSV and Excel exports leave the system daily.
• APIs expose it to other systems and other entities.
• Machine-learning feature stores derive training data from it.

The golden rule: classification follows the data wherever it goes. Every copy and every derivative inherits the source's label until a deliberate assessment says otherwise. And derivation cuts both ways: aggregation can lower sensitivity (a total customer count versus the customer list), while combination can raise it (two Restricted datasets joined together may reveal Secret-level insight).

If labels live in an Excel sheet at headquarters while the data flows through dozens of systems, the label reflects where the data was yesterday — not where it is today.

Why manual classification fails at scale

Manual classification works in a pilot and then stalls at scale, for recurring reasons:

• Volume. Thousands of tables and tens of thousands of columns; even a careful reviewer spending minutes per column would need years to finish.
• Inconsistency. Two reviewers assign the same data two different levels, weakening the classification's defensibility under audit.
• Drift. Schemas change weekly and new pipelines appear; a one-time inventory is stale before it is approved.
• Disconnection from enforcement. A label recorded in a document does not change database permissions and does not stop an export.
• Propagation blindness. Manual processes classify the sources, and nobody reclassifies the fourteen derived copies sitting in downstream systems.

Automation: patterns, inheritance, and lineage

Three mechanisms work together so that the human role shifts from manual execution to review and approval:

1. Pattern-based discovery

Saudi data has recognizable shapes: ten-digit national ID and iqama numbers, IBANs beginning with SA, mobile numbers in +9665 format, commercial registration numbers, email addresses, dates of birth. Automated profiling scans columns and suggests the appropriate sensitivity tags — suggestions, not verdicts; a steward confirms them.

2. Structural inheritance

Sensible defaults flow downward: from business domain to database, schema, table, and column. An HR domain might default to Restricted, with sensitive personal columns elevated above that. New tables are born with a default classification instead of being born unclassified.

3. Propagation through lineage

Data lineage maps how data moves between systems, and labels propagate along it automatically: downstream copies inherit their sources' classification, and conflicts — a Secret column feeding a report labeled Public — are flagged for review. This is the only mechanism capable of keeping thousands of derived assets consistent with their sources.

Humans stay in the loop

Automation proposes; ownership and stewardship decide. Data stewards approve suggestions through review queues, and an audit trail records who confirmed what and when — exactly the kind of evidence an NDMO assessment asks for.

A practical rollout sequence

1. Adopt a classification policy aligned with the four national levels and your sector regulator's guidance.
2. Inventory data assets in a data catalog — you cannot classify what you cannot see.
3. Classify critical domains first: personal data, financial data, and anything shared externally.
4. Switch on automated discovery and inheritance to cover the rest of the estate.
5. Tie labels to real consequences: access policies, sharing approvals, masking, and retention periods.
6. Schedule periodic review and reclassification under the data stewards' supervision.

The takeaway

Classification is not a labeling exercise; it is the addressing system on which every other governance control relies. A label that does not travel with the data is an opinion. A label enforced through the catalog, lineage, and access policies is a control.

Goava was built around this idea: classification tags live in the catalog, propagate automatically through lineage, and are enforced through governance policies, with the national levels supported out of the box. If you are standing up a classification program in your organization, talk to us.