Data quality vs data integrity: definitions and Saudi requirements
Data quality asks whether your data is good enough for the job. Data integrity asks whether the data has been protected against unauthorised or accidental change, destruction or loss. The comparison below explains the difference and lists the Saudi standards and legal provisions that apply to each.
Nikolay Zuykov · Agenticum · 3 November 2026
Data quality vs data integrity: the short answer
Data quality is about whether data is good enough for its intended use. Data integrity concerns protection against unauthorised or accidental changes, destruction or loss.
The UK medicines regulator (MHRA) defines data quality as "the assurance that data produced is exactly what was intended to be produced and fit for its intended purpose." The UK Government Data Quality Framework calls it "fitness for purpose". Saudi Arabia's NDMO standards make the same point in their own words: the aim is that "data is fit for purpose based on consumers' requirements."
NIST defines data integrity as "a property whereby data has not been altered in an unauthorized manner since it was created, transmitted, or stored." A second NIST glossary entry, taken from CNSSI 4009-2022, widens this: integrity is the property that data "has not been changed, destroyed, or lost in an unauthorized or accidental manner." Saudi Arabia's National Cybersecurity Authority (NCA) defines integrity as "protection against unauthorized modification or destruction of information."
The MHRA distinguishes data quality from data integrity. Its guidance says the controls required for integrity "do not necessarily guarantee the quality of the data generated." In other words, integrity controls on their own do not necessarily make data fit for use.
Side-by-side comparison
| Field | Data quality | Data integrity |
|---|---|---|
| Definition | Data is fit for its intended purpose (MHRA, UK framework, NDMO) | Data has not been altered in an unauthorised manner since it was created, transmitted or stored; the CNSSI definition adds accidental change, destruction and loss (NIST, NCA) |
| Question it answers | Is this data set good enough for what I want to use it for? | Has the data been protected against unauthorised or accidental changes, destruction or loss? |
| Typical failure | Missing values, duplicates, out-of-date records, wrong format, values that do not match reality, sources that disagree | Unauthorised or accidental change, destruction or loss |
| Main controls | Data quality rules, profiling against those rules, issue reporting (NDMO) | Data and information protection (NCA ECC-2:2024 control 2-7) |
| Saudi reference | NDMO Data Quality domain; PDPL Articles 14 and 17(1) | NCA ECC-2:2024; PDPL Article 19 |
| Sources | MHRA GxP data integrity guidance; UK Government Data Quality Framework; NDMO standards | NIST glossary (incl. CNSSI 4009-2022); NCA ECC-2:2024 |
Why the two terms get confused
Part of the reason is that regulators define integrity in different ways. The US FDA's CGMP guidance says "data integrity refers to the completeness, consistency, and accuracy of data." The MHRA's definition is broader: data integrity is "the degree to which data are complete, consistent, accurate, trustworthy, reliable" and those characteristics are "maintained throughout the data life cycle." Completeness, consistency and accuracy are also NDMO data quality dimensions, so these definitions overlap.
The NIST and NCA definitions are about change, destruction or loss. They do not mention accuracy, completeness or consistency.
ALCOA adds to the overlap. In the MHRA's words, ALCOA stands for "Attributable, Legible, Contemporaneous, Original, and Accurate", and ALCOA+ adds "Complete, Consistent, Enduring, and Available." The MHRA itself notes that ALCOA "was historically regarded as defining the attributes of data quality." That historical use is one reason the quality and integrity terms overlap.
For this comparison, we use the NIST and NCA definitions of integrity and define quality as fitness for purpose.
The six data quality dimensions, with a check for each
NDMO specification DQ.2.1 lists six dimensions. The check column gives example rules, not rules taken from NDMO.
| Dimension | NDMO definition | Example check |
|---|---|---|
| Completeness | The degree to which the necessary data is available for use | Percentage of records with every mandatory field filled |
| Uniqueness | The degree to which data records are unique, and not duplicates | Count of records sharing the same national ID or customer number |
| Timeliness | The degree to which data is up to date and available when it is needed | Share of records updated within the agreed refresh period |
| Validity | A degree of records' conformance to format, type and range | Dates parse as dates; phone numbers match the expected pattern |
| Accuracy | A degree to which data values align to real values | Sample records checked against the source document |
| Consistency | A degree to which data is consistent across different sources | The same customer has the same address in the CRM and in billing |
The UK framework gives similar definitions of accuracy and validity. It describes accuracy as "the degree to which data matches reality" and validity as "the degree to which the data is in the range and format expected."
What protects data integrity in practice
The safeguards below follow from the definition of integrity. They are practical suggestions, not requirements quoted from the sources. Restrict data changes to authorised users and processes. Check for unauthorised changes or accidental loss during transfers, migrations and storage. Consider ALCOA+ as a record-keeping framework.
In Saudi Arabia, NCA ECC-2:2024 control 2-7, Data and Information Protection, aims "to ensure confidentiality, integrity, accuracy, and availability of the entity's data and information." Accuracy is also an NDMO data quality dimension.
Saudi Arabia: who requires what
NDMO standards (SDAIA). The National Data Management and Personal Data Protection Standards have 77 controls and 191 specifications across 15 domains. The Data Quality domain has 4 controls and 13 specifications. The standards cover public entities and also extend to "business partners handling government data." The first-priority data for quality management "shall include, at minimum, the Entity's master data." The standards hand the Data Security and Protection domain to another body: they say it "shall be addressed by the National Cybersecurity Authority (NCA)."
NCA ECC-2:2024. The Essential Cybersecurity Controls apply to government agencies and to "all private sector entities owning, operating, or hosting Critical National Infrastructures." NCA also "strongly encourages all other entities in the Kingdom" to use them as best practice.
Personal Data Protection Law (PDPL). This law covers both sides for personal data. Article 14 says a controller may not process personal data "without taking sufficient steps to verify the Personal Data accuracy, completeness, timeliness and relevance", which is a quality duty. Article 17(1) says that when data is corrected or updated, the controller must notify "all the other entities to which such Personal Data has been transferred." Article 19 requires "organizational, administrative and technical measures to protect Personal Data", which is the integrity and security side.
Operating in the UAE
The country-specific requirements discussed here are limited to Saudi Arabia. If you operate in the UAE, consult the applicable legal texts or seek legal advice before deciding which requirements apply.
A 7-step starter checklist
- Rank your data by priority and make sure your master data is in the first-priority set, as NDMO requires.
- Write data quality rules for each of the six dimensions, based on what the people who use the data need.
- Profile the data against those rules and report the issues you find (the NDMO initial assessment).
- Find the root cause of each issue, fix it at the source, and pass corrections on to every entity that received personal data (PDPL Article 17).
- Restrict who can change data to authorised users and processes.
- Check before and after each transfer or migration for unauthorised changes or accidental loss.
- Run the quality rules and integrity checks again on a fixed schedule, not once.
Sources
- NIST CSRC Glossary: data integrity
- MHRA: GxP Data Integrity Guidance and Definitions
- US FDA: Data Integrity and Compliance With Drug CGMP
- UK Government Data Quality Framework
- SDAIA NDMO: National Data Management and Personal Data Protection Standards
- NCA: Essential Cybersecurity Controls (ECC-2:2024)
- SDAIA: Personal Data Protection Law (English text)