DAMA-DMBOK and Saudi Arabia’s NDMO Standards: An Enterprise Implementation Guide

What the NDMO standards actually require

Saudi Arabia's National Data Management Office (NDMO), part of the Saudi Data and Artificial Intelligence Authority (SDAIA), publishes the Data Management and Personal Data Protection Standards. They are the most detailed public-sector data management specification in the region, and they are more prescriptive than most leaders expect.

The structure is simple to describe:

• 15 domains, from Data Governance to Personal Data Protection. The fifteenth, Data Security and Protection, is delegated to the National Cybersecurity Authority (NCA), so NDMO itself specifies 14.
• 77 controls grouping related requirements within each domain.
• 191 specifications, each a concrete outcome the entity must demonstrate.
• Three priority levels. 76 specifications are Priority 1, 98 are Priority 2 and 16 are Priority 3.

The standards apply to all public entities in the Kingdom, and to business partners handling government data. That second group is routinely overlooked. If you are a systems integrator, a managed-service provider or a software vendor operating government data, the standards apply to the government data in your custody.

Two things stand out in the distribution. Data Governance alone carries 28 specifications, 18 of them Priority 1. And the domains most organizations associate with "real" data work, such as Data Quality, Data Operations and Data Architecture, are dominated by Priority 2 requirements. That imbalance matters more than it looks, and we return to it below.

Three rules that change how you plan

1. Compliance is assessed per specification, on evidence

The standards define compliance at the level of each specification. In the original methodology, a specification that is fully implemented scores 100%, and one that is partially implemented or not implemented scores 0%. Scores roll up to control, domain and entity level.

SDAIA's National Data Index (NDI), the instrument now used to measure government entities, keeps the evidence-based approach. An entity is compliant with a specification only when its supporting evidence meets the acceptance criteria in full. The NDI also includes a separate maturity assessment of 42 questions across the 14 domains, scored from Level 0, "Absence of Capabilities", to Level 5, "Pioneer". A third component, Operational Excellence, measures how actively the entity uses national platforms such as the National Data Catalog, the Government Service Bus and the National Data Lake.

The practical consequence: "mostly done" is a planning category, not a scoring category. Programs should track specifications as complete-with-evidence or not complete, nothing in between.

2. The priorities are a build order, not a menu

The standards were written around a three-year roadmap: all Priority 1 specifications in year one, Priority 2 added in year two and Priority 3 in year three. The NDI compliance assessment covers all 191 specifications, so the priority labels are no longer a reason to defer anything. What they still provide is the correct sequence, because later specifications depend on earlier ones.

3. Personal data has two regimes

The Personal Data Protection domain in the standards sits alongside the Personal Data Protection Law (PDPL), which became enforceable on 14 September 2024 and applies to every organization processing personal data in the Kingdom, public or private, as well as to entities outside the Kingdom processing data about its residents. PDPL obligations include notifying SDAIA of qualifying breaches within 72 hours, registering on the National Data Governance Platform where required, and controls on cross-border transfers. Fines reach SAR 5 million per violation, can be doubled for repeat offences, and disclosure of sensitive data with intent to harm can carry imprisonment.

An NDMO program that treats privacy as one of fourteen domains, rather than as a live legal obligation with its own regulator, is under-scoped.

The paper-compliance trap

Read the Priority 1 specifications closely and a pattern emerges. Most of them ask for a plan, a policy, a role or an assessment:

• DG.1.1: a Data Management and Personal Data Protection Strategy.
• DG.4.3: appoint a Chief Data Officer.
• MCM.1.1: a Data Catalog Plan.
• DQ.1.2: a Data Quality Plan.
• PDP.1.2: a Personal Data Protection Plan.

The capabilities those plans describe mostly arrive in Priority 2. The Data Catalog automated tool itself is specification MCM.5.1, Priority 2. Data quality rules, monitoring, tooling and service levels are DQ.2.1 to DQ.2.5, all Priority 2. Privacy notices, consent management and data subject rights are Priority 2.

This creates a predictable failure. An entity hires a consultancy, produces strategy, plans and role charters at speed, and scores well on Priority 1. Then the specifications that require something to operate arrive: a populated catalog with assigned stewards, quality rules executing on real data, a breach process that has actually been exercised. The plans were written for compliance rather than execution, nobody owns them, and the score stalls.

The fix is not to skip the plans. It is to write each plan as the operating design of a capability you will start running within months, and to build the evidence trail as a by-product of operating it.

Where DAMA-DMBOK fits

DAMA International's Data Management Body of Knowledge is the most widely used reference for how data management work is done: roles, activities, deliverables, techniques and metrics for each knowledge area. This article references the revised second edition, DAMA-DMBOK2R, published in 2024. DAMA describes that revision as a maintenance release: terminology was standardized, data governance is now framed as a "function" rather than a "program", and data quality gained a currency dimension, but no knowledge areas were added or removed. NDMO's domain structure is clearly influenced by DAMA, but the two documents have different jobs.

Mapping the two shows how far DAMA's method carries each NDMO domain.

Most NDMO domains line up closely with one or two DAMA knowledge areas. Four do not, and they are where generic international playbooks are weakest:

• Data Classification: covered in method, not in scheme. DAMA defines and assigns confidentiality levels within Data Security, records them as metadata, and sets the policy through Data Governance. Its example scheme runs from "general audience" to "restricted confidential". NDMO replaces that with a mandated national scheme: an impact assessment for every dataset mapping high, medium, low and no impact to Top Secret, Secret, Confidential and Public, plus a test of whether low-impact data can be published rather than kept Confidential.
• Data Value Realization: partly covered. DAMA treats data asset valuation as a Data Governance concept, defining data as an intangible asset in the 2024 revision, and lists sponsoring valuation as a governance activity, with value realized through BI and data science. NDMO goes further, requiring a continuous pipeline of value-generating use cases and charging models for government data.
• Freedom of Information: partly covered. The closest DAMA practice is records management and e-discovery in Document and Content Management, finding and producing records in response to legal requests, with transparency addressed in Data Handling Ethics. DAMA does not address a citizen's right of access to government information. NDMO adds the request process, response obligations and the appeal mechanism.
• Open Data: largely uncovered. DAMA-DMBOK discusses open data only as an external source an organization might acquire, not as publishing its own data. The building blocks exist (a "general audience" confidentiality level, data sharing agreements in Data Integration and Interoperability) but the open-by-default principle, dataset identification and publication through the national Open Data Platform come entirely from NDMO.

For these four domains, DAMA gives a sound foundation at best, and the requirements that are assessed come from Saudi regulations, national platforms and public-sector processes.

A capability-first roadmap

The roadmap below follows NDMO's build order but organizes the work around capabilities that start operating early, rather than documents that are filed.

Three design choices make the difference:

1. Scope by critical data, not by domain. Choose the datasets that matter most, such as the records behind core services and the master data that every system depends on, and take them through classification, cataloging, quality rules and stewardship first. A small set of fully governed critical data elements produces more NDI evidence, and more value, than a thin layer across everything.
2. Implement the catalog tool early. It is formally Priority 2, but metadata population, stewardship assignment, data quality publication and many access workflows depend on it. Entities that defer it rebuild their Priority 1 inventories later.
3. Appoint stewards with real time. The standards name business and IT data stewards, a compliance officer, a personal data protection officer and a legal advisor. In practice, the program works when stewardship is a recognized part of named people's jobs, with time allocated and performance objectives attached.

Make evidence a by-product

Because compliance is assessed on evidence, the cheapest program is one where operating the capability generates the evidence automatically.

The strong column is not more work. It is the same work done in a system that keeps records, instead of being written up afterwards for an assessor.

If you are a vendor, partner or multinational

Private organizations meet these requirements in three ways:

• As a business partner of a government entity. If you host, process or manage government data, the standards apply to that data. Expect contract clauses, audits and evidence requests that mirror the entity's own NDI obligations.
• As a controller or processor under the PDPL. This applies regardless of sector. Map personal data flows, confirm your lawful bases, establish the 72-hour breach process, review cross-border transfers and assess whether you need a data protection officer.
• As a supplier competing on trust. Entities under NDI scrutiny increasingly prefer partners who can show catalog-ready metadata, classification-aware handling and auditable access controls without being asked.

What to do in the next 90 days

1. Baseline against all 191 specifications with evidence, using complete or not complete only. Record which existing documents would actually pass acceptance.
2. Identify your critical data elements: the 20 to 50 that matter most to core services, reporting and AI ambitions.
3. Confirm the operating roles: CDO, data owners, business and IT stewards, compliance, privacy and legal. Give them allocated time, not only a title.
4. Select and start implementing the catalog tool, and connect it to the national platforms you are measured on.
5. Classify the critical datasets using the prescribed impact assessment, and challenge every "Confidential" label on low-impact data.
6. Run a breach tabletop exercise against the 72-hour PDPL notification requirement.
7. Rewrite Priority 1 plans as operating designs, with owners, dates and the evidence each activity will produce.

Governance capability is also the foundation for everything that follows in analytics and AI. For how that connects to value, see From AI Experimentation to Enterprise Value.

Frequently asked questions

What are the NDMO data management standards?

They are the Data Management and Personal Data Protection Standards published by Saudi Arabia's National Data Management Office. They define 191 specifications across 77 controls and 15 domains for public entities and business partners handling government data.

How is NDMO compliance measured?

Through SDAIA's National Data Index, which combines a maturity assessment, an evidence-based compliance assessment against the 191 specifications, and an operational excellence assessment of national platform use.

Do the NDMO standards apply to private companies?

They apply to business partners handling government data. Separately, the Personal Data Protection Law applies to all organizations processing personal data in Saudi Arabia, and to entities abroad processing data about its residents.

How does DAMA-DMBOK relate to the NDMO standards?

NDMO specifies mandatory outcomes; DAMA-DMBOK describes how to design and operate data management capabilities. Most NDMO domains map closely to DAMA knowledge areas. Data Classification, Data Value Realization and Freedom of Information are only partly covered, and Open Data, as the publishing of an entity's own data, is largely outside DAMA-DMBOK. The national classification levels, charging models, citizen request process and open-by-default publication come from NDMO.

Sources and further reading

• Data Management and Personal Data Protection Standards, Version 1.5, National Data Management Office, SDAIA. Specification counts, priorities, compliance methodology and classification levels.
• National Data Index, Version 1.1, SDAIA, November 2024. NDI components, maturity levels and compliance scoring.
• National Data Index overview, SDAIA.
• The DAMA Guide to the Data Management Body of Knowledge (DAMA-DMBOK2R), 2nd edition, revised, DAMA International, 2024. Chapters on Data Governance, Data Security, Document and Content Management, and Data Integration and Interoperability.
• DAMA-DMBOK 2.0 revision: summary of changes, DAMA International. The 2024 revision is a maintenance release with no new knowledge areas.
• DAMA-DMBOK2R knowledge area context diagrams, DAMA International.
• Data protection laws of the world: Saudi Arabia, DLA Piper. PDPL scope, breach notification, transfers and penalties.

This article is general guidance, not legal advice. Confirm specific obligations against current SDAIA, NDMO and NCA publications.