Resources · Compliance
Data classification in Saudi Arabia: the levels, and what they mean for where your systems run
Data classification in Saudi Arabia gives each class of an organisation's data a level that reflects the harm if it reached the wrong people. The levels come from the Data Classification Policy of SDAIA's National Data Management Office (NDMO). The level decides where a system may be hosted, the order of a cloud migration, where backups go and where the recovery site sits. This guide explains the levels, what they change in design, and where Interkey helps and where it does not.
Published 9 min read
Orientation
At a glance
The guide in one table, for the reader with five minutes.
- What it means
- A level for each class of data, set by the impact of unauthorised access or disclosure
- Who issues the policy
- SDAIA's National Data Management Office, as part of the national data governance policies
- The levels
- Top Secret, Secret, Restricted and Public, in the policy edition published on SDAIA's site
- Who applies it
- Government entities first; a company handling their data under contract asks the entity what level it carries and what that requires
- What it changes in IT
- Hosting location, migration order, backups, the recovery site, logs and test copies
- What Interkey does
- Turns each class into a written hosting decision, then designs, migrates and operates, with support from Riyadh
In short, for executives
- What it is: a level per class of data that decides how it is protected, who reaches it and where it may be hosted.
- Where the levels come from: the Data Classification Policy of SDAIA's National Data Management Office: four levels, set by impact.
- Why IT cares: cloud controls and residency decisions start from the level, so no provider or region comes first.
- What it does not settle alone: NCA controls, personal data rules and sector regulators can add conditions.
What data classification is, and who issues the policy in the Kingdom
Data classification is a decision made for each class of data: what harm would follow if it were disclosed or reached someone without the right to see it. Permissions, encryption, sharing and hosting all rest on that answer.
In the Kingdom, the National Data Management Office of the Saudi Data and AI Authority (SDAIA) issues the national data governance policies, among them the Data Classification Policy. It rests on assessing impact: on the national interest, the entity's work, individuals and their privacy, and the environment. The impact becomes a level. SDAIA's Data Sharing Policy then ties approval to share data between entities to that level.
Read more
This is government data classification first: the policy is written for government entities and the data they hold. A private company handling such data under contract should ask the entity in writing what level it carries and what that requires. We do not repeat article numbers here; the texts are updated, so read the current one on SDAIA's site with your data management owner.
Data classification levels in Saudi Arabia
Names and impact as in the edition of the SDAIA data classification policy published on SDAIA's site. NDMO's interim regulations name the third level "Confidential" rather than "Restricted", so confirm which edition your entity applies. The last column holds questions to answer, not a ready ruling.
| Level | Impact behind it | What to settle before choosing hosting |
|---|---|---|
| Top Secret | High impact if disclosed or reached without the right | What the data owner and the text that applies to you allow. The narrowest options: get the answer in writing before any design |
| Secret | Medium impact | Whether the provider's licence covers this level, where backups and the recovery site sit, who connects for support |
| Restricted | Low impact | The access and encryption controls required, and whether copies may go to SaaS tools or test |
| Public | No notable impact from disclosure | It can be published, but integrity and availability still matter: who may change it, how it comes back after an outage |
Residency is decided per class of data, and classification is what divides data into classes. The guide to data residency in Saudi Arabia sets out where data can run today, and the NCA ECC guide covers how the scope of NCA's controls is described.
Why data classification comes before every cloud decision in the Kingdom
The National Cybersecurity Authority's Cloud Computing and Hosting Cybersecurity policy template states that data is classified under the relevant regulations before it is hosted with a cloud or hosting provider, and that the provider states in writing the classification levels it is licensed to host. NCA also publishes the Cloud Cybersecurity Controls, currently CCC-2:2024, and its ECC-2:2024 document notes that data localisation controls have moved to the NDMO at SDAIA.
Read more
The Digital Government Authority's cloud adoption guideline for government agencies refers to the same classification policy, and CST publishes a Guide for Cloud Computing Service Providers. So "where do we host this system?" has no answer before "what level is its data?". Teams that pick the provider first usually redesign halfway through.
Data classification and cloud hosting: what each level means for where a system runs
There is no rule here of the kind level X is hosted in place Y: the answer comes from the text that applies to you and from the provider's licence, and both change. The route to it is three questions per class:
- May the data leave the Kingdom? If not, the options are in-Kingdom: Google Cloud's Dammam region (me-central2), the AWS Saudi Region once it is in AWS's list of available Regions (announced; not listed on 2 November 2026), or your own data centres.
- Does the provider's licence cover this level? Get the provider's written statement of the levels it is licensed to host, and file it, dated, with the decision.
- Does the class need infrastructure only you control? Some entities keep their highest levels on systems they run themselves; that is the data owner's call.
- Most estates end up as a mix. The guide to enterprise hybrid cloud covers running one estate in more than one place.
How classification shapes cloud migration, backup and disaster recovery
Classification decides the location of every copy of a system, not only the main one. These are the decisions we most often see left late:
| Design decision | What classification settles | Often missed |
|---|---|---|
| Migration order | Which systems move first; public and restricted data usually have the shorter path | A system that depends on a higher-level database inherits its level |
| Target location | The region or infrastructure allowed for each class | Needed services missing from the allowed region |
| Backups | Where copies go and who reaches them, at the source system's level | A copy in a region outside the Kingdom because it was the default |
| Disaster recovery | The recovery site, a second location needing the same answer | A site never tested by restoring, or placed where the level does not allow |
| Logs and monitoring | What may go to an outside platform, and what is masked first | Error messages carrying classified values |
| Test environments | Whether data may be copied there, or is masked first | A full production copy in test, with weaker protection |
| Support access | Who connects to the systems, and from where | A provider engineer connecting from abroad, or receiving an extract |
The guide to disaster recovery in Saudi Arabia covers recovery-site patterns and testing, and the cloud migration page shows how migration waves are ordered.
How an organisation builds a classification that design can use
The classification that helps IT is a list of data classes and the systems that hold them. Start from systems: each one, the classes of data in it, and each class's owner. The owner assesses the impact, and the level is recorded with its date and approver.
In databases, tools help with the hardest part, finding sensitive data. Redgate's documentation describes Redgate Test Data Manager as proposing sensitive columns automatically for the data owner to review, which also serves test data masking, as the PDPL compliance guide explains. But the tool proposes; it does not classify. The level rests on impact, and the owner knows the impact, not the software.
Classification does not replace the personal data rules. Personal data can sit at any level, and the Personal Data Protection Law governs it, transfers abroad included. Record both for each class: its level, and whether it holds personal data.
A checklist before any system moves to the cloud
Questions to answer for each system before a provider or region is chosen:
- The system's data classes written down, each with a known owner.
- An approved, dated level per class, naming the policy edition used.
- The system takes its highest level, unless higher data is separated out.
- A written statement from the provider of the levels it is licensed to host.
- Every copy listed: backups, recovery site, logs, test environments.
- A personal data flag on each class that holds it, so transfer conditions are checked.
- A review date, because data added to a system can raise its level.
Where the cloud and Interkey help, and where they do not
The cloud helps when the classification is clear and written: public and restricted data usually move easily, and an in-Kingdom region opens the way for higher classes if the text and the provider's licence allow. It does not help as a substitute for a missing classification, or for a class that may not leave systems the entity controls; there, private infrastructure stays the answer, run with the same discipline.
Read more
Interkey is a Google Cloud partner and an AWS partner, and builds on both, in-Kingdom options included, and on private infrastructure. We do not set your levels or interpret the policy; that is for your data management and compliance owners. We turn the approved classification into a written hosting decision per system, then a design, migration and operation that match it. If your plan already matches, we say so.
How a classification-to-hosting engagement with Interkey runs
Interkey's engineers work from Riyadh and write documents and meet your teams in Arabic and English. Support after go-live comes from the same team, so whoever designed the recovery site explains it to the auditor.
-
List the systems and classes.
Each system, the classes of data in it, the owner of each class, and every copy.
-
Read the existing classification.
The approved level for each class, and the classes not yet classified, for their owners to classify.
-
Write the hosting decision.
For each system: the allowed location, the provider's licence, the backup target and recovery site, and who approved it.
-
Order the migration.
Waves by level and dependency, usually starting with the systems that have the shortest path.
-
Build and operate.
Landing zone, migration, recovery tested by restoring, and a regular review of the classification and the decision.
Questions Saudi buyers ask about data classification
What are the data classification levels used in Saudi Arabia?
The edition of the Data Classification Policy on SDAIA's site names four levels, Top Secret, Secret, Restricted and Public, set by the impact of disclosure from high to none. The third level's name differs between editions, so use the one your entity applies.
Do private companies have to follow the national data classification policy?
The policy is written for government entities and their data. A private company handling such data under contract asks the entity in writing what level it carries and what that requires. Your sector regulator may add rules of its own.
Can data classified as Secret be hosted in a public cloud inside the Kingdom?
The answer is in the text that applies to you and in the provider's licence, not a general rule. NCA's cloud policy template says the provider states in writing the levels it is licensed to host. Ask for it, and show it to the data owner before design.
Do backups and the recovery site take the same classification as the source system?
Usually yes, because they hold the same data, so they need the same answer on residency and provider licence. The copy most often forgotten is one in an outside region, chosen because it was the default.
How long does mapping data classification to a hosting plan take, and what drives the cost?
It depends on the number of systems, whether an approved classification exists, and whether each class has an owner who can answer, so we estimate after listing the systems. Cost follows the build, migration and licences, quoted in one proposal with support.
Who should own data classification inside an organisation?
Each data class's owner assesses the impact and proposes the level; the data management office approves it. IT describes the systems and copies and applies what the level requires. Tools can propose sensitive columns, but do not decide the level.
Next
Related pages
Next step
Plan hosting by data classification
Tell us which systems you are thinking of moving, whether you have an approved classification today, and where backups and the recovery site sit now. We will come back with a first step showing what may be hosted where, and what the classification is missing.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia