Gate into «Submitted»DecisionGoDate2 June 2026DraftComplete
Gate into «Initial review»DecisionGoDate30 June 2026SubmittedComplete
Gate into «Feasibility»DecisionGoDate28 July 2026Initial reviewComplete
Gate into «Evaluation»DecisionGoDate25 August 2026FeasibilityComplete
Gate into «Committee review»DecisionGoDate22 September 2026EvaluationComplete
Gate into «Approved»DecisionGoDate20 October 2026Committee reviewComplete
Gate into «Prioritized»DecisionNot held yetNext gateApprovedCurrent stageCurrent stage
Gate into «Converted to project»DecisionNot held yet8PrioritizedNot started
9Converted to projectNot started
The request as filed
What the requester wrote on the intake form
Problem
There is no single data-protection and classification policy for public bodies, and the gap assessment found 37 controls missing in the government systems the Authority follows.
Current state
Most bodies have no data protection officer, there is no record of processing, and 12 systems collect citizens’ personal data unclassified.
Objective
A national data-protection and classification policy adopted by public bodies, applied in the main government systems before the end of 2027.
Expected scope
Drafting the policy and guides, appointing data protection officers, the record of processing, privacy notices on the unified e-services platform, impact assessments for 12 systems, and breach-notification procedures, with the Ministry of Communications and IT.
Expected benefits
Compliance
All 37 compliance gaps closed
Savings
Avoids the cost of data breaches and system rebuilds
At the initiation gate the national steering committee made classifying the partner bodies’ data under the approved data-protection policy a condition.
Recommendation: Tie any analytics, AI or survey request to the data-governance outputs and name the data owners before evaluation.
