Data Classification in Saudi Arabia: Levels, Labels, and Automation

Why classification is the gateway control

Data classification is the control that every other control depends on. Before an organization can decide who may access a dataset, where it may be stored, whether it can be shared with another entity, or when it must be destroyed, it first has to answer a simpler question: how sensitive is this data?

That is why classification sits at the heart of the NDMO framework. The National Data Management Office's framework spans 15 domains, 77 controls, and 191 specifications — and data classification is one of those domains, not as a paperwork exercise but as the prerequisite for protection, sharing, and lifecycle management.

The Personal Data Protection Law (PDPL) raises the stakes further. Fully enforced since September 2024 under SDAIA's authority, it carries penalties of up to SAR 5 million — and up to SAR 10 million for repeat violations. You cannot protect personal data you have not identified, and you cannot identify it reliably without a working classification program.

The four national classification levels

Saudi Arabia's national data classification policy defines four levels, each assigned according to the impact that unauthorized disclosure would cause:

• Top Secret (سري للغاية). Data whose disclosure would cause exceptional, grave damage to national interests — national security, the Kingdom's economy, foreign relations — or endanger people's lives and safety. Access is restricted to the narrowest possible circle.
• Secret (سري). Data whose disclosure would cause serious damage to national interests, to the activities of entities, or to the interests and privacy of individuals.
• Restricted (مقيد). Data whose disclosure would cause limited negative impact on an entity's operations or on individuals. Most internal operational data and routine personal data falls here.
• Public (عام). Data whose release causes no harm and which may be published without restriction.

How a level is chosen: impact assessment

The level is not chosen by intuition. It comes from a structured assessment of disclosure impact across defined dimensions: national interest, the entity's activities, reputation and finances, individuals' privacy and safety, and the environment. The highest applicable impact determines the level.

Classification has two opposite failure modes. Under-classification exposes sensitive data; over-classification blocks legitimate sharing and open-data initiatives. Good practice therefore mandates periodic review, with reclassification or declassification when the original justification no longer applies.

Labels must travel: how classification propagates

A classification label assigned to a table in a source system is only the beginning, because data does not stay in one place:

• ETL pipelines copy it into staging environments and data warehouses.
• Dashboards and reports aggregate and re-present it.
• CSV and Excel exports leave the system daily.
• APIs expose it to other systems and other entities.
• Machine-learning feature stores derive training data from it.

The golden rule: classification follows the data wherever it goes. Every copy and every derivative inherits the source's label until a deliberate assessment says otherwise. And derivation cuts both ways: aggregation can lower sensitivity (a total customer count versus the customer list), while combination can raise it (two Restricted datasets joined together may reveal Secret-level insight).

If labels live in an Excel sheet at headquarters while the data flows through dozens of systems, the label reflects where the data was yesterday — not where it is today.

Why manual classification fails at scale

Manual classification works in a pilot and then stalls at scale, for recurring reasons:

• Volume. Thousands of tables and tens of thousands of columns; even a careful reviewer spending minutes per column would need years to finish.
• Inconsistency. Two reviewers assign the same data two different levels, weakening the classification's defensibility under audit.
• Drift. Schemas change weekly and new pipelines appear; a one-time inventory is stale before it is approved.
• Disconnection from enforcement. A label recorded in a document does not change database permissions and does not stop an export.
• Propagation blindness. Manual processes classify the sources, and nobody reclassifies the fourteen derived copies sitting in downstream systems.

Automation: patterns, defaults, and lineage

Three mechanisms work together so that the human role shifts from manual execution to review and approval:

1. Pattern-based discovery

Saudi data has recognizable shapes: ten-digit national ID and iqama numbers, IBANs beginning with SA, mobile numbers in +9665 format, commercial registration numbers, email addresses, dates of birth. Generic detectors catch formats such as email addresses; Saudi-specific ones such as national ID, iqama and SA IBAN numbers usually need patterns added for each organization. Automated profiling scans columns and suggests the appropriate sensitivity tags — suggestions, not verdicts; a steward confirms them.

2. Structural defaults

Agree sensible defaults from the top down: from business domain to database, schema, table, and column. An HR domain might default to Restricted, with sensitive personal columns elevated above that. Each new table then starts from its domain's default when it is onboarded, instead of staying unclassified.

3. Classification along lineage

Data lineage maps how data moves between systems, and classification can follow it: lineage shows every downstream copy of a classified source, so each one can be classified to match, and a conflict — a Secret column feeding a report labeled Public — is visible before it becomes a breach. It is the only practical way to keep thousands of derived assets consistent with their sources.

Humans stay in the loop

Automation proposes; ownership and stewardship decide. Data stewards approve suggestions through review queues, and an audit trail records who confirmed what and when — exactly the kind of evidence an NDMO assessment asks for.

A practical rollout sequence

1. Adopt a classification policy aligned with the four national levels and your sector regulator's guidance.
2. Inventory data assets in a data catalog — you cannot classify what you cannot see.
3. Classify critical domains first: personal data, financial data, and anything shared externally.
4. Switch on automated discovery, and use domain defaults and lineage to cover the rest of the estate.
5. Tie labels to real consequences: access policies, sharing approvals, masking, and retention periods.
6. Schedule periodic review and reclassification under the data stewards' supervision.

The takeaway

Classification is not a labeling exercise; it is the addressing system on which every other governance control relies. A label that does not travel with the data is an opinion. A label enforced through the catalog, lineage, and access policies is a control.

Goava was built around this idea: classification tags live in the catalog on datasets, columns and API endpoints, glossary terms carry their linked tags to every asset they are applied to, and the national levels can be modelled as a classification of their own. Governance workflows route label changes for review, while enforcement stays in your security stack. If you are standing up a classification program in your organization, talk to us.