Back to Guides

A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube

Guide Origin: Community | ArcKit Version: [VERSION]

/arckit:uae-classification generates a UAE Smart Data Classification Register, mapping every dataset in scope to one of the four UAE Smart Data Framework classes — Open, Confidential, Sensitive or Secret — with handling rules and a declassification schedule. Anchored on the UAE Smart Data Framework.

This is the upstream artefact for the UAE federal overlay — most other UAE commands consume it.

Inputs

Artefact Purpose
Architecture principles (ARC-000-PRIN-*.md) Federal principles applied to classification
Requirements (ARC-<id>-REQ-v1.0.md) Datasets in scope of the service
Data model (ARC-<id>-DATA-v*.md) Per-entity sensitivity inputs
governance_framework: UAE Federal and classification_scheme: UAE Smart Data user-config

Command

/arckit:uae-classification <project ID or service name>

Output: projects/<id>/ARC-<id>-CLAS-v1.0.md

Assessment Structure

Section Contents
Classification Levels Used Open / Confidential / Sensitive / Secret with anchor definitions
Dataset Register Per-dataset row with classification, owner, source, and rationale
Handling Rules per Level Storage, transit, access, retention, declassification
Cross-Reference Index Links from dataset → data model entity, requirements, residency rule
External References Smart Data Framework citations

One-Page Workflow

Phase Key Activities ArcKit Commands
Discovery Define service and datasets /arckit:requirements, /arckit:data-model
Classification Map datasets to Smart Data ladder /arckit:uae-classification
Residency Validate per-classification residency /arckit:uae-cloud-residency
Privacy Map PDPL lawful basis to classified data /arckit:uae-pdpl
Sharing Per-share sensitivity controls /arckit:uae-data-sharing

Review Checklist

  • Every dataset in the service appears in the Dataset Register.
  • Every dataset classified above Open has a documented rationale — Open is the framework's default for non-personal data.
  • Handling rules cover storage, transit, access, retention, and declassification.
  • Cross-references back to data model entities resolve.
  • Confidential and above flagged for sovereign-cloud residency.
  • Owner named for every dataset (no "TBD").

Key Notes

  • Four classes: The UAE Smart Data Framework sets four classes — Open, Confidential, Sensitive and Secret. The source is Part 1: Smart Data Principles and Standards (v2.0, February 2019), Data Classification Standard DC1, with the criteria and examples for each class in Part 2: Smart Data Implementation Guide (v2.0, March 2019), Guidance Note 5.1. Both are published on the UAE Government portal at https://u.ae/en/about-the-uae/digital-uae/data/data-operability. In the framework, Shared and Closed are exchange modes (how data moves between entities), not classes, and there is no Top Secret class.
  • Earlier ArcKit releases used a five-rung ladder (Open / Shared / Confidential / Secret / Top Secret). Nothing blocks a document that still carries those labels. Re-label it when it is next revised: Shared usually becomes Confidential, Top Secret becomes Secret, and a dataset labelled Confidential under the old ladder, which sat one rung higher, may now be Sensitive.
  • Upstream artefact: uae-cloud-residency, uae-pdpl, and uae-data-sharing all depend on this register being in place.
  • userConfig governs the non-UAE artefacts: The uae-* commands write UAE-regime doc-types, and those render the Smart Data ladder whoever runs them — regime beats user config at the marker-resolution step. Set governance_framework: UAE Federal and classification_scheme: UAE Smart Data so that the jurisdiction-agnostic artefacts produced alongside them (requirements, ADRs, risk register and similar) carry the same ladder rather than the UK one. See templates/_partials/RENDERING.md for the full resolution order.
  • Migration: To switch an existing UK-classified project, run arckit migrate-classification --root projects --apply (see uae-overlay.md).
  • Community-contributed: Output should be reviewed by qualified DPO / federal compliance counsel before reliance.