NDMO & PDPL Readiness

Know exactly where you stand against NDMO and PDPL, before someone else tells you

A scoped maturity assessment against the national data management domains and the Personal Data Protection Law, producing a scored gap register, a remediation roadmap and an evidence pack written for reviewers rather than for us.

Where this sits

Foundation

Intelligence

Agents

Our point of view

What we are seeing in the market

Observations from the engagements and tenders we work on across Saudi Arabia and the wider Gulf.

The grace period is over

PDPL moved from published law to enforced law. Organisations are now being asked to show how consent, retention, cross-border transfer and data-subject rights work in their systems, not in a policy document.

Maturity is scored, not declared

National data management standards are assessed domain by domain. A score is produced whether or not you prepared for it, and the gaps become someone's remediation plan regardless.

Residency ownership moved

Cloud controls were rewritten and residency questions now sit with the data authority rather than only with the cybersecurity control set. Teams are answering last year's question and getting this year's finding.

The work

What this practice delivers

Domain-by-domain maturity scoring

Governance, architecture, quality, metadata, reference and master data, integration, retention, classification and protection, each scored with the evidence that justified the score.

PDPL control walkthrough

Lawful basis, consent capture, purpose limitation, retention, subject-access handling, breach notification and cross-border transfer traced through the systems that actually hold the data.

Gap register with owners and sequence

Every gap written as a fixable item with an owner, a dependency and a place in the sequence, so remediation can start without a second discovery exercise.

Evidence pack a reviewer can read alone

Lineage, classification, access and retention exported as artefacts rather than screenshots, so the next assessment is retrieval instead of a project.

How the work is structured

From an unknown position to a scored, evidenced one

Scope

Systems in scope
Data categories

Assess

NDMO domains
PDPL controls

Score

Maturity per domain
Evidence behind it

Sequence

Gap register
Remediation roadmap

Evidence

Exportable artefacts
Reassessment ready

Remediation writes back into the evidence pack, so the next score is produced from the platform rather than assembled by hand

Selected work

Work we have delivered

Client identities are withheld. The situations, the build and the change afterwards are as they happened.

Maturity assessment

A Saudi government entity

The situation: A data management score had been produced externally and nobody internally could explain which systems drove the weak domains.
What we built: A traced assessment that connected each weak domain to named systems, owners and missing artefacts, then a sequenced remediation plan.
What changed: The next cycle was prepared from evidence the platform produced rather than from a manual scramble.

PDPL readiness

A regional financial institution

The situation: Personal data was duplicated across analytics copies with no consistent retention or classification.
What we built: Classification carried from source, retention enforced in the platform, and subject-access requests answered from lineage instead of a search across teams.
What changed: Requests moved from an ad-hoc investigation to a repeatable procedure with a record.

Where we are strongest

We are strongest when a compliance question has to be answered from the systems rather than from a policy binder.

Assessment tied to engineering

The people who score the gap can also close it, so the report does not stop at describing the problem.

Regulator language, not imported labels

Findings are written in the vocabulary the reviewer uses, in Arabic and English, so nothing has to be translated during review.

Evidence generated, not collected

Wherever possible the artefact comes from the platform itself, which is what makes the next assessment cheap.

Residency answered precisely

We separate what must remain in-country from what may not, and record the reasoning behind each decision.

Straight answers

Questions we are asked most

Is this an audit?

No. It is a readiness assessment. We produce the score and the evidence you would need if an assessment or an enforcement question arrives.

Can it cover only one business area?

Yes. Scoping to one domain or one platform is common, and the same method extends outward later without redoing the work.

What happens after the report?

The gap register is a work plan. Your team can run it, we can run it, or we can run the parts that need platform engineering.

Clients

Organisations we work with

Across banking, healthcare, government, retail, energy and telecom.

FAQ

Frequently asked questions

What does an NDMO data management maturity assessment involve?

A domain-by-domain review of governance, architecture, quality, metadata, master and reference data, integration, classification, retention and protection, each scored against the national standards with the supporting evidence recorded.

Is PDPL compliance mandatory now?

Yes. The Personal Data Protection Law applies to organisations processing personal data in Saudi Arabia, the transition period has ended, and supervision is active, so readiness needs to be demonstrable rather than intended.

Where does data residency sit now?

Residency is treated as a data governance question tied to the classification of the data and the applicable national data rules, alongside the cloud cybersecurity controls, so the answer depends on what the data is, not only on where the workload runs.