Compliance

Data classification

Tiered categories indicating data sensitivity.

How the laws define this

Both frameworks define data classification as a system for categorizing information into distinct sensitivity levels, such as public or internal tiers, to determine appropriate security measures, handling rules, and protections. They diverge primarily in the specific obligations and operational contexts that classification governs. Under the Draft Personal Data Protection Act / Draft Data Protection Act 2023, classification functions as a statutory model where categorizing data dictates legal processing conditions, data localisation, tiered cross-border transfer safeguards, and compliance duties like registration requirements and DPIA for higher-risk classes. Conversely, the Generative AI Guidelines for Government (SDAIA) frames classification as a data management regime that determines access controls, retention, and permitted technology uses, specifically driving controls such as prohibitions on using classified data and protections for personal or sensitive information.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

Bangladesh's Draft Personal Data Protection Act would require localisation or tiered transfer safeguards and inform DPIA and registration requirements for higher-risk classes.

Definitions (2)

A statutory model proposed in the draft that categorises data into tiers (e.g., public, private, internal, confidential, restricted) to prescribe differentiated security, processing and cross-border transfer conditions. Classification drives obligations such as localisation or tiered transfer safeguards and informs DPIA and registration requirements for higher-risk classes.

Draft Personal Data Protection Act / Draft Data Protection Act 2023Definition 1 of 2

A data management regime that categorizes datasets and information according to sensitivity and handling requirements (e.g., public, internal, sensitive, classified), to determine appropriate protections, access controls, retention, and permitted GenAI uses. Classification drives controls such as prohibitions on using classified data and specific protections for personal or sensitive information.

Generative AI Guidelines for Government (SDAIA)Definition 2 of 2

Not to be confused with

Classification Levels

Classification levels mandates sensitivity tiers specifically for government data, while data classification applies more broadly to datasets and information.

Data Classes

Data classes refers to a specific five-tier system from Open to Secret, whereas data classification encompasses various tiered categories like public or confidential.

Questions and answers

How does Bangladesh's draft act handle data classification?

It categorises data into tiers like public, private, confidential, and restricted. This prescribes differentiated security, processing, and cross-border transfer conditions. Higher-risk classes would trigger DPIA and registration.

What obligations arise from data classification in these instruments?

In Saudi Arabia, it recommends GenAI use restrictions and protections. In Bangladesh's draft, it would impose tiered safeguards, localisation, DPIAs, and registrations.