Do the NDMO controls apply to private companies?

The data management controls are directed at public entities, while the personal data provisions reach much wider. Private firms in regulated sectors are increasingly asked for the same artefacts by their own regulator or by government clients.

Where does an assessment usually lose points?

Catalogue freshness and quality evidence. The policies exist, the roles are named, and then the inventory turns out to describe last year's platform.

Can we do this without replacing our platform?

Usually yes. Most of the work is metadata, ownership and rules layered onto what is already running. Replacement is a separate decision with its own reasons.

How does this connect to PDPL?

They share a spine. Classification, lineage and ownership are what let you answer a rights request and evidence a control at the same time, which is why we build them once.

Data governance

NDMO data management controls, turned into work a data team can actually do

The national controls read as domains and specifications. Delivery reads as catalogues, owners, quality rules and lineage. This page maps one onto the other.

Book the Data Foundation Assessment AI governance practice

An assessment score moves when the catalogue is populated by the pipeline, not by a spreadsheet campaign.

NDMOSDAIAPDPL

The short answer

The National Data Management Office publishes Saudi Arabia's data management and personal data protection controls, organised into domains such as governance, catalogue and metadata, quality, architecture, and open and shared data. Public entities are assessed against them. Meeting them is mostly platform work: named owners, a live catalogue, measurable quality rules and lineage that reaches the report.

Key takeaways

What you need to know, in a minute

Domains are not departments

The control domains cut across the platform. Treating each as a separate project is why assessments stall between cycles.

Ownership is the first control

Nothing else holds without a named data owner and steward per domain. Quality rules with no owner go unfixed.

Metadata has to be generated

A catalogue filled in by hand is stale within a quarter. It has to be emitted by the pipelines that create the data.

Quality needs a number

Completeness, validity, uniqueness and timeliness are measured per critical data element, trended, and tied to the owner who can act.

From the text to what gets built

Each line is a published expectation and what we implement against it. None of this is legal advice or a compliance verdict.

Area	What it asks for	What we build
Data governance	Defined roles, policies and a governing forum.	An owner and steward per data domain, with decisions recorded where the data lives rather than in meeting minutes.
Catalogue and metadata	A maintained inventory of data assets and their meaning.	Catalogue entries emitted by the pipeline, business glossary linked to physical columns, freshness visible.
Data quality	Measured quality against defined dimensions.	Rules that run in the pipeline, break the build on critical failures, and report a trend per owner.
Data architecture	A described, standard-conforming data landscape.	Reference architecture, integration standards and a lineage graph that survives change.
Data classification and protection	Classified assets with protection matching the class.	Classification applied at ingestion and inherited downstream, with access and residency following the class.
Open and shared data	Publish and exchange data under the national rules.	Publishing pipelines with anonymisation, versioning and a documented interface for consuming entities.

Control gap read

We walk the controls against the platform as it exists and mark each one evidenced, partial or absent, with the artefact that would close it.

Catalogue and glossary build

Automated harvesting from sources and pipelines, then the business meaning attached by the people who own it.

Quality rule programme

Critical data elements identified first, rules written against them, and failures routed to an owner rather than a dashboard.

Assessment evidence

The artefacts an assessor asks for, produced from the running platform so the next cycle does not start from zero.

Use cases

Where this applies in practice

Questions we get on NDMO controls

Related guides

PDPL

Most gaps we find are not legal gaps. They are missing lineage, missing classification and copies nobody owns.

Open the guide

SDAIA alignment

The ethics principles are not decoration. They decide which decisions a model is allowed to make alone.

Open the guide

NCA Essential Cybersecurity Controls

Most audit findings on a data platform are access findings. Shared accounts and forgotten service credentials, not exotic attacks.

Open the guide

SAMA expectations

The question is rarely whether the model works. It is whether you can reconstruct one decision from eighteen months ago.

Open the guide

In-country hosting

The failure is almost never the main database. It is a notebook, a support tunnel or a model API nobody classified.

Open the guide

Etimad

A bid rarely loses on the model. It loses on the appendix nobody prepared.

Open the guide

Let's put your AI ambition on the table

Sixty minutes with a senior Bilytica partner. We stress-test your plans against what actually works in your sector, agree which moves are worth funding first, and you leave with a written 90-day plan and honest numbers, whether you work with us or not.

Start the conversation