Data Classification Policy

Terminology

Personal Data: Every statement – regardless of its source or form – is likely to lead to the specific knowledge of an individual, or make them identifiable directly or indirectly when combined with other data, including - but not limited to - name, personal identification numbers, addresses, contact numbers, bank account and credit card numbers, static or moving images of the user, and other personally identifiable data.

Data: A collection of facts in their original form or in an unorganized form such as numbers, letters, static images, videos, audio recordings, emojis, or symbols.

Access to Data: The ability to logically and physically access university data and technical resources for the purpose of using them.

Verification: Confirming the identity of any user, process, or device as a fundamental requirement for allowing access to technical resources.

Protected Data: Data classified as (Highly Confidential, Secret, Restricted).

General Information: Data after processing (unprotected) that the university receives, generates, or deals with, regardless of its source, form, or nature.

Data Classification Levels: The classification levels as displayed in the Data Classification Policy by the National Data Management Office are as follows: Highly Confidential, Secret, Restricted, Public.

Business Data Representative: The person responsible for the data collected and stored in business departments within the university.

Security Controls: The devices, procedures, policies, and physical guarantees used to ensure the safety of data, protect its processing, and access it.

Disclosure of Data: Enabling any person – other than the University – to obtain, use, or access data in any manner and for any purpose.

Data User: The employee who deals with data, accesses it, uses it, or updates it for the purpose of performing a task authorized by the University’s authority.

goal policy

The purpose of this policy is:

Organizing the process of classifying and protecting data at Najran University in accordance with best global practices and in compliance with instructions from relevant authorities.
Organizing the process of using/reusing protected data and publishing general information.
Specify the roles and responsibilities required from all parties in the University to ensure the optimal implementation of data classification.

scope of policy

These rules apply to all data that the University receives, generates, or handles, regardless of its source, form, or nature, including paper records, meetings, communications through social media and applications, emails, data stored on electronic media, audio or video tapes, maps, photographs, manuscripts, handwritten documents, or any other form of information.

Roles and Responsibilities

The Entity	Roles and Responsibilities
The Permanent Supreme Committee for the Management and Governance of Data	Policy Approval Approval of the Timeline Plan for University Data Classification. Addressing any difficulties or challenges that hinder the data classification process.
The Permanent Committee for Data Quality and Decision Support	Overseeing the University’s data classification process in accordance with applicable systems, regulations, and specifications while enhancing secure access methods. Proposing solutions to improve data classification procedures. Recommending escalation to the Permanent Supreme Committee for Management and Governance of Data when necessary.
Data Management Office	Reviewing the data classification policy periodically. Proposal for the formation of subcommittees – in accordance with what requires the interest of work to complete the tasks related to data classification – and submission for approval by the authorized person. Following up on the work of the specialized subcommittees in data classification to ensure that all university data is classified by representatives of the relevant business units. Proposal of procedural evidence for data classification and recommendation, and its endorsement by the Permanent Supreme Committee for Data Management and Governance. Following the periodic reports of subcommittees for data classification. Reviewing internal and external data sources, recording data storage locations and the responsible party for their management. This includes: Confirming the availability of a data sharing agreement for external entities. Confirming the security standards used when exchanging data between internal and external entities within the university. Enhance awareness among university staff (faculty and employees) regarding the importance of data governance, its classification methods, exchange practices, and dissemination strategies.
Business Administration (and includes all colleges and units in the University)	University business departments will apply the approved university data classification policy, including: Limiting and classifying all data assets (including all incoming paper transactions within the institution that have not been recorded in any of the university’s systems). Nomination of a business representative to be adequately informed on the nature of the administrative unit's data. Data classification references for review and approval of business data classification levels. Data classification within the entity based on what is stated in this policy.
Business Data Representative	Each business administration unit will appoint a data representative to perform the following tasks: Data classification: Classifying the data collected by the entity and its affiliated departments and offices. ? Data aggregation: Ensuring that data aggregated from multiple sources are classified at the highest levels of classification used in classifying them individually. ? Data classification harmonization: Ensuring that exchanged data is classified and protected in a coordinated manner. ? Compliance with data classification (in coordination with Business Data specialists): Ensuring that data is protected according to specified controls.
Digital Transformation Deanship - Knowledge Sources	Applying controls to data based on its approved classifications by the Data Management Office. Technical and informational support for business administration units, including but not limited to: Cataloging electronic databases within the University systems. Providing and updating metadata for databases for electronic systems at the University, based on approved models from the Data Management Office and sharing them with concerned organizational units. Applying the necessary security and protection to electronic data in the University based on its classification. Reporting cybersecurity administration and the Data Office about violations that are detected and which expose data to risk. Performing regular backups of business data. Restoring data from backup media when needed.
Business Data Specialist	The Digital Transformation Deanship, Knowledge Sources and Cybersecurity Administration, under the mandate of the following tasks are undertaken: Ensuring the application and monitoring of access controls and their review according to data classification levels defined by the Business Data Specialist. Preparing periodic reports on the quality, integrity, security and sharing of classified data with related departments. Compliance with data classification (in collaboration with data officers). Ensuring the classification of the party's data and its protection according to the specific controls in this policy.
Cybersecurity Administration	Supervision and monitoring of the implementation of data controls according to the approved classification and ensuring alignment with policies and controls issued by the National Cyber Security Authority. Coordination with the Financial Administration to provide software necessary for detecting and protecting data leaks. Monitoring of activities performed on data and their recording, including data related to the person accessing this data and sharing it periodically with the Data Management Office to achieve compliance with implementing this policy.
Governance and risk management and business continuity management	Reviewing compliance reports on the application of the data classification policy, methods for storing this data, and identifying the consequences of not complying with the necessary security measures for preserving data and sharing these reports with the University’s Data Management Office.
Internal Audit Management	Following up on the availability of compliance reports with the data classification policy by business departments in the university according to the schedule for implementing this policy.
Data User	The Data User commits to complying with this policy and all policies related to using data in Saudi Arabia.

Data classification principles

The First Principle: The Origin of Data Availability

The origin of data is that it should be available (in the developmental field) unless its nature or sensitivity requires higher levels of classification and protection, and extreme secrecy (in the political and security fields) unless its nature or sensitivity requires lower levels of classification and protection.

The Second Principle: Necessity and Proportionality

Data is classified into levels according to its nature, level of sensitivity, and degree of impact, taking into account the balance between its value and degree of secrecy.

The Third Principle: Classification at an Appropriate Time

Data is classified when it is created or received from other parties, and the classification should be within a specified time period.

The Fourth Principle: Higher Level of Protection

The highest level of classification should be adopted when its content includes a comprehensive set of data with different classification levels.

The Fifth Principle: Separation of Duties

Separation of tasks and responsibilities of employees - regarding the classification, access, disclosure, use, modification, or destruction of data - should be done in a way that prevents overlap of jurisdiction and avoids responsibility diversion.

The Sixth Principle: Need to Know

Access to data and its use should be restricted based on the actual need for knowledge, and for the minimum number of employees.

Principle Seven: Minimum Privileges

Employee authority management is limited to the minimum privileges necessary to perform assigned tasks and responsibilities.

Data classification levels

Classification Level	Impact Rating
Highly Confidential	high
Description
Data is classified as highly confidential if unauthorized access to this data, disclosure of its content, or damage resulting from its content results in severe and exceptional harm that cannot be remedied or corrected as follows: National interests, including breaches of agreements and treaties, damage to the Kingdom's reputation or diplomatic relations, political affiliations and sensitivities, operational efficiency of security or military operations, national economy or national infrastructure, or government activities. Performance of public entities which causes harm to national interests. The health and safety of individuals on a wide scale and the privacy of senior officials Natural resources, the environment or natural resources.
Classification Level	Impact Rating
Confidential	Moderate
Description
Data is classified as confidential if unauthorized access to this data or disclosure of its content or material thereof results in serious harm to: National interests such as causing partial damage to the Kingdom’s reputation or diplomatic relations and/or operational efficiency of security or military operations or the national economy or national infrastructure or government activities. Causes significant financial loss at the regulatory level leading to bankruptcy or inability of entities to perform their tasks or substantial loss of competitive capacity or both together Results in serious harm or injury affecting the lives of a group of individuals. Leads to damage over the long term for environmental or natural resources. Investigation of major issues specified by law, such as terrorism financing cases.
Classification Level	Impact Rating
Restricted	Low
Description
Data is classified as "restricted" if unauthorized access to this data or disclosure of its content or material thereof results in: A limited and specific negative impact on the work of public entities and economic activities in the Kingdom and on the work of a particular individual. Limited damage to the assets of any entity and a limited loss to its financial and competitive position. Limited damage to the near term of environmental or natural resources.
Classification Level	Impact Rating
Available	No
Description
Classified as public data when access to it, disclosure of its content or the consequences thereof do not result in any of the aforementioned effects if they do not affect the following: National Interest. Agency Activities. Individual Interests. Environmental Resources.

Classified data can be classified into sub-levels based on the scope of impact as follows:

Restricted - Level (A): If the scope of impact is at a sector or general economic activity level.
Restricted - Level (B): If the scope of impact is at the level of activities of multiple agencies or on the interests of a group of individuals.
Restricted - Level (C): If the scope of impact is at the level of activities of a single agency or on the interest of a specific individual.

The table below clarifies and defines the correct classification level that the University can use to assess the effects resulting from unauthorized access to data or disclosure of its content, and for more information on the impact assessment process, you can refer to the necessary steps for classifying data. The University must conduct an impact assessment of unauthorized access or disclosure. This list is not exhaustive.

Categories and Impact Rating Levels according to Data Classification Levels

			Data Classification Levels
			Highly confidential	secret	Restricted	year
Primary Impact Category, Sub-Impact Category, Considerations			Impact Level
			High	Average	Low	None
National Authority	The Kingdom’s Reputation	Will the information be of interest to local or international media outlets? Will it give a negative impression?	The reputation is significantly affected	The reputation is somewhat affected	The reputation is not affected	There is no impact on vital national interests
National Authority	Diplomatic Relations	Does the information pose a threat to relations with friendly countries? Will it increase international tensions? Could it lead to protests or sanctions from other countries?	The severance of diplomatic relations and political affiliations, or threats to agreements and terms of treaties, or both	Diplomatic relations are negatively affected in the long term	No impact will occur on diplomatic relations or a slight impact will occur in the short term	There is no impact on vital national interests

			Data Classification Levels
			Highly confidential	secret	Restricted	year
Primary Impact Category, Sub-Impact Category, Considerations			Impact Level
			High	Average	Low	None
National Authority	National Security / Public Order	Does the information – if published – assist in organizing terrorist activities or committing serious crimes? Does it constitute a source of panic for everyone?	The operational efficiency of public security or military intelligence operations is significantly affected.	Long-term impact on the ability and efficiency of security agencies to investigate and prosecute serious organized crimes that cause internal instability	Little impact on operational efficiency of security operations at regional or local levels, and preventing the detection of minor crimes in the short term	There is no impact on vital national interests
	National Economy	Does the disclosure of information lead to economic losses at the national level?	Long-term impact on the national economy with a decline that cannot be contained in gross domestic product or financial market prices or unemployment rates or purchasing power or related indicators which negatively affects all sectors in the Kingdom	Long-term impact on the national economy with a decline that can be addressed in gross domestic product, unemployment rate, or financial market prices and purchasing power, which negatively affects one or more sectors	A minor impact on the national economy with a decline that can be addressed in a short period in gross domestic product, employment rate, or financial markets prices or purchasing power, which negatively affects only one sector
	National Infrastructure	Does access to information disrupt critical national infrastructure such as energy, transportation, and communications? In case of cyberattacks, will essential services in the Kingdom remain available?	Shutdown and disruption in the security and operations of national critical infrastructure, as well as affecting many sectors and disrupting normal life	Shutdown and disruption – for a short period – in the security and operations of national critical infrastructure, as one or more sector(s) is affected	No damage or short-term impact on the security and operations of local/regional critical infrastructure
	Government tasks	Will disclosure lead to limiting the ability of government agencies to carry out their daily operations and tasks?	Inability of all government agencies to perform their main tasks and operations for a long period	Inability of one or more government agency(ies) to perform one or more of its/their main tasks for a short period	Inability of one or more agency(ies) to perform one or more of the non-main tasks for a short period
The University and its branches	University works and services	Will disclosure lead to limiting the ability of organizational units in the University from carrying out their operations and tasks?	Inability of all organizational units in the University from performing their main tasks and operations	Inability of more than one organizational unit (e.g., the University, a specific branch, etc.) to perform one or more of its main tasks	Inability of more than one organizational unit (e.g., the University, a specific branch, etc.) to perform one or more of its main tasks	No impact on the University's and its branches’ activities
	The University’s infrastructure	Does access to information lead to disruption of the University’s vital infrastructure (e.g., Information Technology, etc.)? In case of exposure to cyberattacks, will the University's essential services remain available?	Stoppages and outages in the security and operations of the infrastructure in one or more organizational unit, branch or more, leading to disruption of normal life	Partial stoppages and outages in the security and operations of the infrastructure in one or more organizational unit, branch or more	Damage or minor impact on the University’s security and operations of the infrastructure
	Material losses	Does disclosure of information lead to material losses at the University level	Impact on the University with an unmanageable decrease in assets or income or other relevant financial indicators	Impact on the University with a manageable decrease in the University's assets or income or other relevant financial indicators	A minor impact on the University with a manageable decrease that can be addressed in a short period regarding the University’s assets, sources of income, or other relevant financial indicators
Other Entities’ Activities	Private sector revenues	Will the disclosure of information result in financial losses or bankruptcy for private entities managing public facilities? For example, the potential for fraud, illicit fund transfers, and unlawful asset seizures.	A significant negative impact on private entities to the extent that it causes damage to vital national interests	Incurring significant financial losses which may lead to bankruptcy	Limited damage consisting of limited financial loss to the party or any of its assets	There is no impact on the activities of the authorities
Other Entities’ Activities	Private Entity Responsibilities	Would disclosure lead to damage to private entities managing public facilities? Would this lead to a loss of leadership or the loss of any assets?		Inability to perform key tasks and a significant loss of competitiveness	Inability to perform one of the key tasks, and limited loss of competitiveness	There is no impact on the activities of the authorities
			Data Classification Levels
			Highly confidential	secret	Restricted	year
Primary Impact Category, Sub-Impact Category, Considerations			Impact Level
			High	Average	Low	None
Individuals	Health / Individual and Personnel Safety	Will disclosing information lead to the disclosure of names or locations of individuals, and so on? (For example, names and locations of secret clients, and people under special protection systems)	Significant or catastrophic loss of life; loss of the life of an individual or group of individuals	Serious harm or injury threatening the life of an individual	Minor injury without any danger threatening the life or health of an individual	No impact on individuals
Individuals	Privacy	Will disclosing information lead to a violation of the privacy of individuals? Will this lead to a violation of any intellectual property rights?	Disclosure of personal data of a prominent figure affecting national interest	Disclosure of personal data of a prominent figure	Disclosure of personal data of an individual	No impact on individuals
The Environment	Environmental Resources	Will this information be used to develop a service or product that could lead to the destruction of the Kingdom’s environmental or natural resources?	Catastrophic impact that cannot be remedied on the environment or natural resources	Long-term impact on the environment or natural resources	Short-term or limited impact on the environment or natural resources	No impact on the environment

Data classification guidelines

Unclassified data must be classified – as of the issuance of this policy – within a specified timeframe according to an action plan prepared by the Data Management Office at the University and approved by the President or his designee.
Data that has not been classified upon creation or receipt is treated as “Restricted” until it is classified.
Based on classification levels, appropriate security controls are determined and implemented to protect data, ensuring its handling, processing, sharing, and disposal in a secure manner.
Periodic updates of security systems for monitoring storage devices of classified data – Highly Secret, Secret, and Restricted – to ensure the protection of this data from unauthorized access.
Classified data – Highly Secret, Secret, and Restricted – not under surveillance must be protected during physical and electronic storage using encryption methods approved by the National Cybersecurity Authority.
Labels indicating protection markings should be printed on paper and electronic documents, including emails, according to each classification level.
Access to Highly Secret classified data is restricted through defining access privileges based on the principle of “Need-to-Know,” limiting these privileges to the minimum number of authorized individuals who need to view the data.
Data sharing only occurs according to the approved Data Sharing Policy.
Data retention periods are determined based on relevant business, contractual, regulatory, and legal requirements, and this period is reviewed periodically.
All data will be disposed of securely in accordance with the established security procedures for its disposal.
Data is archived in secure storage locations and according to the method recommended by the business data representative.
A backup of the archived data is maintained.
The archived data that has been classified as “highly confidential” and “confidential” are protected using encryption methods approved by the National Cybersecurity Authority.
A detailed list of authorized users with access to the archived data is prepared and documented.
The classification level of the data (confidentiality level) is reduced to an appropriate level after the expiry of the previous period.

steps data classification

Appointment of Business Representatives:

Decisions regarding the appointment of business data representatives across various administrative units within the university are issued by His Excellency the University President or his designee, based on recommendations from the General Supervisor of Data Office/Director of the Data Office.

Inventorying University Data:

All data owned by the university will be inventoried through business data representatives and participating parties, documenting their data assets. The sources of data within the university can be identified as follows:

Internal Data Sources	These include Business Departments and Internal Systems that generate data for the University by implementing work procedures and services. Examples include, but are not limited to: paper or digital copies of reports produced by internal departments or data derived through systems used.
External Data Sources	These include external parties providing agreed-upon data to the University for implementing work procedures and services. These sources include, but are not limited to: student data providers, relevant government agencies, and other supervisory bodies.

Data exchange channels will be identified, including automated and manual channels. Automated channels encompass all automated and semi-automated channels such as emails, SMS messages, and other channels associated with electronic systems. Manual channels include all non-technical channels such as magnetic disks, USB storage devices, external hard drives, and paper documents.

Conducting an Impact Assessment:

The business data representative must follow the necessary steps to assess the potential impact that may result from:

Disclosing this data or unauthorized access to it.
Modifying, damaging, or both, this data.
Lack of access to this data in a timely manner.

The impact assessment process begins by applying the principle of "data availability as a default" (in the development sector) unless its nature or sensitivity require higher levels of classification and protection with extreme confidentiality (in the political and security sectors) unless its nature or sensitivity require minimal levels of classification. The first element of the impact assessment process is to identify the main and sub-category of the potential impact within any of the following main categories:

National Interest
Activities of Entities
Health or Safety of Individuals
Environmental Resources

Determine the Impact Level:

The business data representative must determine a specific level for each potential impact based on:

The duration and difficulty of controlling the damage.
Recovery and damage remediation period after occurrence.
The extent of the impact at national, regional, multiple entities, a single entity, several individuals... etc.].
As can be determined by the criteria below:
High – accessing data or disclosing it leads to serious or extremely dangerous damage over the long term that cannot be recovered or remediated.
Medium – accessing data or disclosing it leads to serious or difficult-to-control damage.

Low – accessing data or disclosing it leads to limited damage that can be controlled, or intermittent damage over the short term that can be controlled.
No impact, accessing data or disclosing it does not lead to any damage over the long or short term.
All potential and identified damages during an impact assessment process should be specified and based on evidence, in an attempt to limit subjective estimates by the person responsible for data classification. The business data representative determines the data classification level based on the identified impacts and their levels:
High – Data is classified as “Highly Confidential”.
Medium – Data is classified as “Confidential”.
Low – Further assessments are required (through performing steps 5, 6)
No impact, data is classified as "Public" data.

Identify Related Systems (if the impact level is low):

Additional assessments must be conducted if the specified impact level is “low” in order to maximize the classification of data classified as “public” data. In this regard, the business data representative should study whether disclosing this data conflicts with Saudi Arabian systems such as the Cybercrime Prevention System and the E-Commerce System… etc. If disclosure of the data violates the systems, the data must then be classified as “restricted” data; otherwise, the business data representative must continue to implement step 5.

Balancing Disclosure Benefits and Negative Impacts (if the answer to Step 5 is "no"):

Following confirmation of the low impact level and ensuring that disclosure will not be a violation of any existing system, it is also necessary to assess the potential benefits of disclosing such data and determine whether these benefits outweigh the negative impacts. Potential benefits include using the data to develop new value-added services, increasing government operational transparency, or increasing individual engagement with the government. Accordingly:

If the benefits are greater than the negative impacts, the data is classified as “public”.
If the benefits are less than the negative impacts, the data is classified as “restricted”.

Review of Classification Level:

All data classifications must be reviewed by -one of the staff in the Data Management Office at the University- to ensure that the level of classification specified by the business data representative is appropriate, and this review will take place within one month of the initial classification.

Applying appropriate controls:

The final step in the data classification process is to protect all data according to the classification level by generalizing the results of the classification and applying data classification controls. The classification process will be completed upon classifying all data owned by the University and verifying classification levels and applying relevant controls.

Breadcrumb

Data Classification Policy