Data Classification: Practical Guide for Saudi Companies

Why Data Classification Matters

Data classification is the first step in any information security strategy. Without classification, you cannot determine the required level of protection. Treating all data at the same level means either overspending on data that does not need high protection or neglecting sensitive data that needs maximum protection.

Data classification answers one question: What happens if this data is leaked, lost, or altered?

The Saudi Classification Framework

National Cybersecurity Authority (NCA)

NCA adopts 4 classification levels:

Level	Definition	Examples
Top Secret	Leakage threatens national security	Defense data, intelligence
Confidential	Leakage causes significant organizational harm	Financial data, strategic plans
Sensitive	Leakage causes limited harm	Personal data, contracts
Public	Available to everyone	Marketing content, news

Personal Data Protection Law (PDPL)

PDPL adds special classification for personal data:

• Regular personal data: Name, email, phone number
• Sensitive personal data: Health, financial, biometric, criminal, ethnic data

Sensitive personal data requires stronger protection and more detailed explicit consent.

How to Classify Your Data — Step by Step

Step 1: Data Inventory

Create a comprehensive list of all data types you hold:

Customer data:

• Names, phone numbers, and addresses
• Transaction records and invoices
• Payment data (cards, bank accounts)
• Support ticket records

Employee data:

• Personal information (ID, address)
• Salary and financial data
• Performance evaluations
• Health records

Operational data:

• Source code
• Production databases
• Configuration files and keys
• System logs

Public data:

• Website and blog content
• Marketing materials
• Published pricing

Step 2: Impact Assessment

For each data type, assess the impact of leakage:

Assessment Criteria	Confidential	Sensitive	Public
Financial impact	Major loss (100K+ SAR)	Moderate loss	No impact
Legal impact	Fines + lawsuits	Potential fines	No impact
Reputation impact	Severe damage	Limited damage	No impact
Operational impact	Complete shutdown	Partial disruption	No impact

Step 3: Define Controls

Each classification level requires different controls:

Confidential:

• Mandatory encryption (AES-256) at rest and in transit
• Access limited to named individuals
• Logging of every access operation
• Saudi storage only — no exceptions
• Encrypted backup

Sensitive:

• Encryption in transit (TLS)
• Role-based permissions
• Access logging
• Saudi storage preferred

Public:

• Protection against unauthorized modification
• Regular backup
• No location restrictions

Step 4: Document the Policy

Document everything in a formal document that includes:

• Classification table with clear examples
• Responsibilities for each team
• Reclassification procedures
• Internal violation penalties

Common Classification Mistakes

1. Classifying everything as "Confidential" — devalues the classification and increases cost without benefit
2. Not updating — data changes over time. A completed project's data may shift from "Confidential" to "Public"
3. Ignoring derived data — a report aggregating sensitive data = the report itself is sensitive
4. Not training employees — the best policy is useless if the team does not know it
5. Classification without controls — classification without enforcement = a worthless document

Classification Tools

• Microsoft Purview — automatic classification of files and email
• OpenDLP — open source, discovers sensitive data
• Manual classification — suitable for small and medium businesses

Data Classification and Hosting

Classification determines where data is stored. "Confidential" and "Sensitive" data requires a Saudi server. CLOUD provides servers in Riyadh designed to host classified data — with encryption, backup, and access logs.

Start classifying today. This is the foundation everything else is built on.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.