Definitions

Data: A collection of facts in its original form or in an unorganized form such as numbers, letters, static images, videos, audio recordings, emojis.

Applicant: Any government entity or private entity or individual who submits a request to share data.

Data Source Entity: The governmental entity concerned – according to its systematic competencies – in establishing the technical standards for a specific field or set of data fields, and verifying their accuracy and retention criteria.

Authorizing Entity: The entity authorized to share data pursuant to authorization from the Data Source Entity according to the procedures outlined in this Policy, following taking the necessary steps to ensure the freshness of the data.

Data Requesting Party: Any governmental entity to which a request to share data is submitted, whether it be the Data Source Entity or the Authorizing Entity.

Parties Involved in Data Sharing: Any party involved in the data sharing process, including the applicant and the data requesting party.

Data Sharing Agreement: A standard agreement signed between two parties – when data is shared from a government entity to a private entity or individual – that defines the roles and responsibilities of the parties involved in the data sharing process according to the provisions and controls specified in this Policy.

Data Sharing Controls Template: A standard template that includes the necessary controls for handling data, defining roles and responsibilities if the parties involved are governmental entities.

Authority: The Saudi Data and Artificial Intelligence Authority.

Office: National Data Management Office.

Entity Office: Data Management Office in the Governmental Entity.

Government Integration Channel: A secure channel for sharing data between government agencies with the aim of achieving integration and connectivity between them and enabling them to automate their own services.

Data Market: A platform aimed at automating all data sharing operations – in accordance with the provisions of this policy – between government agencies; it allows agencies to automatically request subscriptions to published data sharing services (APIs) listed on the platform or request new services. The Data Market is one of the national data repositories.

Descriptive Data: Detailed information that describes data and its usage characteristics, whether business data, technical data, or operational data.

Goal

The purpose of the data sharing policy is to promote data sharing to achieve integration between government entities and to obtain data from its sources. This policy is in line with policies issued by the National Data Management Office – Legislative Arm of the Saudi Data and Artificial Intelligence Authority. It aims to comply with data management and governance requirements, and related legal and regulatory requirements, which is a legislative requirement in Specification No. DG.1.2 of the National Standards for Data Management and Governance and Personal Data Protection (Version 1.5) issued by the National Data Management Office.

scope

These provisions apply to all data generated by the University, regardless of whether it is shared with other government agencies or private entities or individuals, whatever the source, form, or nature of the data, including paper records, email messages, electronic media data, audio, video, maps, photographs, manuscripts, handwritten documents, or any other form of recorded data. These provisions do not apply if the requesting party is a government agency and the request is for security purposes or to comply with judicial requirements.

Principles of data sharing

Principle 1: To promote a culture of sharing, the University must share its key outputs and this is to achieve integration between them and government agencies and adopt the “Single Version” principle to obtain data from its correct sources and reduce its duplication, conflict and multiplicity of sources. In case of a request for data from sources other than its primary source, the University must obtain approval from the main source – the data source – before sharing it with the requesting party.

Principle Two: Legitimate purpose shall be to share data for legitimate purposes based on systematic or practical need, a justified objective aimed at achieving public interest without causing any harm to national interests, or activities of entities or the privacy of individuals or environmental safety – excluding data and entities excluded by royal decrees.

Principle 3: Authorized access shall be granted to all parties participating in the sharing of data, with the right to view, obtain, and use it (which may require security scanning according to the nature and sensitivity of the data), in addition to knowledge, skills, and people properly trained to handle shared data.

Principle Four: Transparency All parties involved in data sharing operations must make available all necessary information for data exchange, including: the required data, the purpose of its collection, the means of its transfer, methods of its storage, the controls used to protect it, and the disposal mechanism.

The Fifth Principle: All parties sharing data must be jointly responsible for data-sharing decisions and processing in accordance with the specified purposes, ensuring the implementation of security controls as stipulated in the data sharing agreement, and relevant systems, legislation, and policies.

The Sixth Principle: Data security shall be applied by all parties involved in sharing data to protect data and share it in a safe and reliable environment in accordance with relevant systems and legislation, and according to the directives of the National Cyber Security Agency.

The seventh principle: Ethical use requires all parties involved in data sharing to implement ethical practices during the data sharing process to ensure its use within a framework of justice, integrity, honesty, and respect, and not to rely solely on compliance with information security policies or compliance with relevant regulatory and legislative requirements.

Steps necessary to conduct a data sharing process

The key steps for data sharing have been determined by the National Data Management Office to assist entities in standardizing practices and ensuring compliance with all relevant controls and requirements – which may not exceed 3 months. The details are as follows:

Firstly: The applicant – whether a government entity, private organization, or individual – submits a data sharing request to the University Data Management Office, with the request being submitted through the requesting entity’s data management office if the applicant is a government entity.

Secondly: The University Data Management Office refers the request to the relevant Business Data Representative who, in turn, directs this request to one of the business data specialists to evaluate and process the request.

Thirdly: The business data specialist verifies the classification level of the required data:

a. If no classification level is specified, the University Data Management Office must classify the requested data in accordance with the data classification policy.

b. If the classification level is indicated as “public,” the business data specialist may share the requested data without evaluating the request according to the main principles of data sharing.

c. If the classification level is indicated as “restricted,” “confidential,” or “highly confidential,” the business data specialist must evaluate the request in accordance with the main principles of data sharing.

Fourthly: The business data specialist at the University Data Management Office must complete the data sharing process if all principles of data sharing are fully satisfied.

Fifth: It is not permissible for the Business Data Specialist in the University’s Data Management Office to continue sharing data if one or more principles of data sharing are not met. The Business Data Specialist must respond to the request with the notes and provide an opportunity to meet all incompatible data sharing principles.

Sixth: Upon meeting all data sharing principles, the Business Data Specialist obtains approval from the Business Data Representative to complete the data sharing process.

Seventh: The Business Data Specialist identifies appropriate controls to ensure compliance with data sharing principles and achieve the specific objectives of each, as well as agreement between the Business Data Specialist in the University’s Data Management Office and the requestor and other parties involved in the sharing process on applying these controls.

Eighth: After agreeing on data sharing controls and committing to their implementation, the Business Data Specialist must clarify them in detail in the agreement, and all participating parties must sign the data sharing agreement.

Ninth: The University’s Data Management Office may share the required data with the requesting party after signing the data sharing agreement.