NDMO Data Management and Personal Data Protection Standards compliance software
Assess the National Data Management Office's standards specification by specification, in priority order, beside the PDPL and the NCA controls the standards leave data security to.
- IssuerNational Data Management Office (NDMO), SDAIA
- EditionVersion 1.5, the source of GRCLens's catalogue
- Domains15: 14 assessed by NDMO, data security and protection by NCA
- Specifications191 under 77 controls in the 14 assessed domains
- Priorities77 at P1, 97 at P2, 16 at P3, and one deferred to NCA
- LanguagesArabic and English
What the NDMO standards require
Who it applies to
- Saudi public entities: ministries, authorities, public institutions and other government bodies
- Business partners and service providers that handle government data for a public entity
- Chief Data Officers and data management offices preparing for NDMO's annual compliance assessment
- Entities answering to both the NDMO standards and the PDPL
The Data Management and Personal Data Protection Standards are published by the National Data Management Office (NDMO), part of the Saudi Data and Artificial Intelligence Authority (SDAIA). They set out how Saudi public entities govern, catalogue, share, classify and protect the data they hold, and they extend to business partners that handle government data for those entities. NDMO checks them through an annual compliance assessment.
The standards are organised in fifteen domains, each divided into controls and specifications, and every specification is marked Priority 1, 2 or 3 to set the order of implementation. NDMO assesses fourteen of the domains: data governance; data catalog and metadata; data quality; data operations; document and content management; data architecture and modeling; data sharing and interoperability; reference and master data management; business intelligence and analytics; data value realization; open data; freedom of information; data classification; and personal data protection. Together they hold 191 specifications under 77 controls. The fifteenth domain, data security and protection, is detailed and assessed by the National Cybersecurity Authority rather than in NDMO's assessment.
SDAIA also administers the Personal Data Protection Law, in force since 14 September 2023. The standards' personal data protection domain addresses the same subject for public entities and the partners handling their data, while the PDPL applies to anyone processing personal data of people in the Kingdom. A Saudi public entity therefore usually answers to the NDMO standards, the PDPL and NCA's controls at once.
Related reading: Saudi Personal Data Protection Law; Gulf data protection: Saudi PDPL vs UAE PDPL
How GRCLens supports NDMO Standards
NDMO Standards runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Generated from the published standard
The catalogue is generated from SDAIA's PDF rather than retyped, and the generator refuses to write unless it finds exactly 77 controls and 191 specifications. A revision of the standard therefore fails loudly instead of leaving a catalogue that is quietly short.
Priority-led assessment
Every specification carries its priority and is answered implemented, partially implemented, not implemented or not applicable. Key risk indicators track the Priority 1 specifications not yet implemented or not yet assessed, and the gaps in personal data protection, data classification, governance and freedom of information.
Data security left to NCA, on purpose
The standard gives data security and protection no specifications because NCA assesses it, so GRCLens does not invent any. Run the NCA Essential Cybersecurity Controls beside the NDMO standards for that domain.
Saudi data obligations together
The NDMO standards, the PDPL and the NCA Essential Cybersecurity Controls run side by side in one tenant, so the three assessments a Saudi public entity usually faces sit on one platform with one audit trail.
Evidence with a human decision
Upload evidence against each specification. Baseerah rates its relevance and confidence, a reviewer accepts or rejects it, and the person who uploaded a file can never approve it.
Owners and assurance
An assurance view records the owner, effectiveness testing and review dates behind each answer, so the next annual assessment starts from a maintained record rather than a fresh spreadsheet.
Arabic and English
Specification text is held in Arabic and English side by side, and the interface and assessment workflow run in Arabic with right-to-left layout.
Reports
Assessment reports in PDF, Word and Excel for the Chief Data Officer, the data management office and the executive committee.
NDMO Standards frequently asked questions
What are the NDMO Data Management and Personal Data Protection Standards?
They are the National Data Management Office's standards for how Saudi public entities manage and protect data, across fifteen domains from data governance and data quality to open data, freedom of information, data classification and personal data protection. NDMO is part of SDAIA.
Who must comply with the NDMO standards?
Saudi public entities, and business partners that handle government data on their behalf. NDMO checks compliance through an annual compliance assessment.
How many domains, controls and specifications are there?
Fifteen domains. NDMO assesses fourteen of them, which hold 191 specifications under 77 controls; the fifteenth, data security and protection, is detailed and assessed by the National Cybersecurity Authority.
What do Priority 1, 2 and 3 mean?
They set the order of implementation: Priority 1 specifications come first, then Priority 2, then Priority 3. In the version GRCLens carries, 77 specifications are Priority 1, 97 are Priority 2 and 16 are Priority 3, and one defers to NCA.
How do the NDMO standards relate to the PDPL?
Both are SDAIA's. The PDPL is a law, in force since 14 September 2023, that applies to anyone processing personal data of people in Saudi Arabia. The NDMO standards are data management standards for public entities and their partners, with a personal data protection domain covering the same subject. A public entity usually needs both, and GRCLens runs them side by side.
Why is data security and protection not in the NDMO assessment?
Because the standard says that domain is detailed and assessed by NCA, not by NDMO. GRCLens leaves it out rather than invent obligations, and covers it through the NCA Essential Cybersecurity Controls assessment.
Does GRCLens support Arabic for NDMO assessments?
Yes. Specification text is held in Arabic and English, and the interface and assessment workflow run in Arabic with right-to-left layout.
One platform, many obligations
See all supported frameworks → Every framework that applies in Saudi Arabia →
Talk to us about NDMO Standards
Security Solution Consultants provides data governance and PDPL advisory in Saudi Arabia alongside the platform, so you can combine tooling with hands-on expertise.