Data Sharing Policy and Procedures

Definitions

  • Data: A collection of facts in their raw form or in an unorganized manner such as numbers, letters, static images, videos, audio recordings, emojis.
  • Requesting Party: Any government entity, private entity, or individual who submits a data sharing request.
  • Source Authority: The governmental authority responsible for establishing technical standards, verifying the accuracy of data, and maintaining it.
  • Appointing Authority: The authority authorized to share data based on delegation from the Source Authority.
  • Data Sharing Entity: Any entity that is a party to the data sharing process, including the Requesting Party and the Data Sharing Entity.
  • Parties Involved in Data Sharing: Any entity involved in the data sharing process, including the Requesting Party and the Data Sharing Entity.
  • Data Sharing Agreement: A standard agreement signed between two parties to define the roles and responsibilities of the parties according to the controls.
  • Data Sharing Controls Template: A standard template that defines the controls, roles, and responsibilities when sharing data between government entities.
  • Authority: The Saudi Data and Artificial Intelligence Authority.
  • Office: National Data Management Office.
  • Agency Office: Agency Data Management Office.
  • Government Integration Channel: A secure channel for sharing data between government agencies to achieve integration.
  • Data Marketplace: A platform aimed at automating data sharing processes between government agencies.
  • Metadata: Detailed information describing data and its usage characteristics.

Objective

The purpose of the Data Sharing Policy is to promote data sharing to achieve integration between government agencies and to obtain data from its sources. This policy aligns with national policies for data and artificial intelligence.

Scope

These provisions of this policy apply to all data produced by the University, whether it is shared with governmental, private, or individual entities, regardless of the source, form, or nature of such data.

These provisions do not apply in cases where the requesting entity is a government agency and the request is for security or judicial purposes.

Key Principles of Data Sharing

  • Promoting a Culture of Sharing: The University shares key data to achieve integration, adopting the “Single Instance” principle for data.
  • Purpose Legitimacy: Data is shared for legitimate purposes in accordance with a system or practical need that achieves public interest without harming national or individual interests.
  • Authorized Access: All participating parties have the right to access and use the data according to their respective authorities.
  • Transparency: All parties are committed to providing all necessary information regarding data sharing, methods of transfer, storage, and protection.
  • Shared Responsibility: All parties are responsible for decisions regarding participation and ensuring security controls as per agreements and policies.
  • Data Security: Implementation of appropriate security controls for data sharing in a secure and reliable environment.
  • Ethical Use: Adherence to ethical practices during data sharing, ensuring fairness and integrity.

Steps Necessary to Conduct a Data Sharing Process

  • First: The applicant submits a data sharing request to the University Data Management Office via the relevant authority’s office if the request originates from a government entity.
  • Second: The University Data Management Office refers the request to the designated business data representative for evaluation and processing.
  • Third: The representative verifies the classification level of the required data and follows the need-based classification policy.
  • Fourth: The representative completes the sharing if all data sharing principles have been met.
  • Fifth: If any principle is not met, the representative must reject the request, specifying the notes and providing an opportunity for modification.
  • Sixth: Upon meeting the principles, the representative obtains approval from the business data representative to complete the sharing.
  • Seventh: The competent authority shall determine the appropriate guidelines and agree upon them with all participating parties.
  • Eighth: Following the agreement on the guidelines, they should be detailed in the agreement and a data sharing agreement should be signed by all parties.
  • Ninth: The University Data Management Office may share the requested data with the requesting party after the agreement has been signed.