Data Governance
Ownership, policies, data quality and a data catalogue that make data trusted, aligned with Saudi Arabia’s NDMO standards and Egypt’s Personal Data Protection Law.
Learn moreNDMO Compliance: Readiness Assessment and Gap Closure
We help public entities in Saudi Arabia, and the business partners that handle their data, measure where they stand against the NDMO Data Management and Personal Data Protection Standards, close the gaps in order of priority and keep the evidence that the annual compliance report and the National Data Index ask for. Delivered from Cairo, with our parent group in Riyadh.
What Does NDMO Compliance Mean?
The National Data Management Office (NDMO), part of the Saudi Data and AI Authority (SDAIA), issued the Data Management and Personal Data Protection Standards (version 1.5, January 2021). They cover fifteen data domains and set 77 controls and 191 specifications across fourteen of them; data security is left to the National Cybersecurity Authority. The standards draw on DAMA, the international data management body of knowledge. Complying with them means being able to show, for every specification that applies to you, that the policy exists, the role is assigned, the practice actually runs and the evidence is kept, and reporting on that every year.
The standards are written for public entities, a term that includes companies running public utilities or national infrastructure, and their scope extends to the business partners that handle government data. SDAIA follows each entity’s progress through the National Data Index (NDI), which combines a maturity score on six levels from 0 to 5, compliance with the 191 specifications and operational excellence. Compliance is therefore measured again and again, not certified once: there is no certificate to buy, only an organisation that manages its data in the way the specifications describe and can prove it.
Sustainable Software Solutions prepares entities for that assessment from Cairo, as the technology arm of Jadara Solutions in Riyadh, whose data practice serves the Saudi market. Our founder established and led the data management office of a Saudi government agency, with a three-year data strategy and a governance framework built to NDMO regulations. We are neither the regulator nor an accredited assessor, and we promise no score: we measure your position against the specifications, close the gaps with your own teams and leave you with the evidence and the routines that keep you compliant after we have gone.
What it covers
What Our NDMO Compliance Work Covers
Eight parts of a compliance programme. We can run the whole programme or take the parts your data management office has not reached yet.
Readiness assessment
A specification-by-specification review of your policies, roles, practices and evidence against the 191 specifications, with a maturity estimate for each domain that applies to you.
Roadmap by priority
The gaps ordered by risk, effort and dependency, so the first quarter closes the ones the compliance report and the index weigh most.
Data management office and roles
The data management office, the governance committee and the data owners and stewards the standards expect, with their decision rights written down and approved.
Policies and procedures
The policy, standard and procedure each domain calls for, written for the people who have to follow them and mapped to the specifications they satisfy.
Catalogue, quality and classification
A data catalogue with business metadata, quality rules measured on your critical data, and a classification applied to every data set.
Personal data protection
A register of the personal data you hold and its flows, aligned with the standards’ personal data domain and the Saudi Personal Data Protection Law.
Evidence and the annual report
One evidence file per specification, kept up to date as routines run, so the annual compliance report is assembled from records rather than written from memory.
National Data Index preparation
Maturity, compliance and operational indicators tracked the way the index scores them, reported to management before the assessment, not after it.
References
The References We Work From
Four public references shape the work. This is a summary of published rules, not legal advice.
The NDMO standards
Data Management and Personal Data Protection Standards, version 1.5 (January 2021): fifteen domains, 77 controls and 191 specifications, with DAMA as a key reference and an annual compliance report.
The National Data Index (NDI)
SDAIA’s measure of government entities: data management maturity on six levels from 0 to 5, compliance with the 191 specifications and operational excellence.
The Saudi Personal Data Protection Law
Royal Decree M/19: in force since 14 September 2023 and fully enforceable since 14 September 2024, supervised by SDAIA. It applies to organisations that process personal data in the Kingdom, public or private.
DAMA-DMBOK
The data management body of knowledge the standards draw on; our assessment and operating-model templates follow its domains, so your programme speaks the same language as the specifications.
How we deliver
How a Compliance Programme Runs
Five steps, each ending in something you can see, test and sign off.
STEP 01
Discover
We interview the people who hold the data, read the policies and registers you already have, and assess each applicable specification, so you see your position before anything is built.
STEP 02
Design
We agree the operating model, the roles, the roadmap and the templates for policies and evidence, starting with the domains the index weighs most.
STEP 03
Build
We write the policies and procedures, build the catalogue, the quality rules and the registers, one domain at a time, with the owners who will run them.
STEP 04
Deploy
We put the data management office to work: routines running, issues tracked, evidence filed per specification and a first compliance report drafted.
STEP 05
Improve
We measure maturity and compliance indicators, prepare you for the National Data Index and extend the programme to the next domains.
Questions & answers
Frequently Asked Questions
What is the NDMO?
The National Data Management Office is the office within SDAIA, the Saudi Data and AI Authority, that sets the national rules for managing and protecting data. It issued the Data Management and Personal Data Protection Standards that public entities in Saudi Arabia comply with and report on every year.
Which organisations must comply with the NDMO standards?
Public entities, including companies that run public utilities or national infrastructure, and, within the scope of the data they handle, the business partners that work with government data. If your organisation receives, stores or processes data on behalf of a public entity, the specifications that cover that data apply to you too.
How many controls and specifications are there?
Version 1.5 of the standards covers fifteen data domains and sets 77 controls and 191 specifications across fourteen of them. The fifteenth, data security, is governed by the National Cybersecurity Authority’s own controls. Not every specification applies to every entity: the assessment starts by establishing which ones apply to you.
Is NDMO compliance a certificate?
No. Entities report on their compliance every year, and SDAIA follows their progress through the National Data Index, which scores maturity, compliance with the specifications and operational excellence. Compliance is a continuing state that has to be maintained and evidenced, which is why we build the routines and the evidence files, not a one-off report.
What does a readiness assessment deliver?
A list of the specifications that apply to you with the status of each (met, partly met, not met), a maturity estimate per domain, an inventory of the evidence you already have and the evidence you lack, and a roadmap that orders the gaps by risk, effort and dependency. It is the document the rest of the programme is planned from.
How does the Personal Data Protection Law relate to the NDMO standards?
The standards include a personal data protection domain, and the Personal Data Protection Law (Royal Decree M/19, fully enforceable since 14 September 2024) sets the legal obligations behind it, under SDAIA’s supervision. The law applies to organisations that process personal data in the Kingdom whether public or private, so a private company may be outside the standards yet still bound by the law. This is general information, not legal advice.
Can a company based in Cairo deliver NDMO compliance work?
Yes. The work is policies, registers, roles and evidence, built with your own teams, and our founder led exactly this kind of programme inside a Saudi government agency. We deliver it from Cairo as the technology arm of Jadara Solutions, whose headquarters is in Riyadh, and we serve Saudi clients alongside the group. We do not have an office in Saudi Arabia and do not claim one.
Do we need to buy a tool to comply?
No specification requires a particular product. Roles, policies, registers and evidence can start in documents and spreadsheets; a catalogue or quality tool earns its place once the volume of data sets and rules outgrows them. We help you choose and run one when that point comes, and we do not sell one.
Keep exploring
Related Services
Data Analytics & BI
Dashboards, reports, analytical portals and self-service BI on governed data, and the data platform that feeds them.
Learn moreTechnology Consulting
Assessment, strategy, architecture and a roadmap grounded in what your teams can actually run.
Learn more
Check Your NDMO Readiness
Tell us which domains apply to you and when your next compliance report is due. We will show you where you stand and what to close first.