How to Start a Data Classification and Analysis Business in Dubai

How to Start a Data Classification and Analysis Business in Dubai

Ask a well-run company of two hundred people what it holds, where each kind of it lives and who can reach it, and nobody will be able to answer. Not because the business is careless, but because the answer was never written down by anyone and the estate grew in fifteen separate decisions taken by people who have since left. That silence is the market. An engagement in this line exists because a question with obvious importance has no answer anywhere in the building, and somebody has finally been asked it by a party who will not accept a shrug.

Data Classification & Analysis, as the activity reads in the catalogue, is two joined pieces of work. Classification sorts what the company holds into tiers by sensitivity and sets out who may see each tier and what may be done with it. Analysis is what the sorted material then reveals — where duplication sits, what is being kept with no reason, which systems hold things nobody knew they held, and which parts of the estate are carrying risk out of all proportion to their usefulness. The first produces a scheme. The second produces the argument for acting on it.

Classification fails in two directions, and the costly one makes no noise

The failure everybody anticipates is under-restriction: something sensitive left where too many people can reach it. It is real, it is the one the client is worried about, and it is comparatively easy to find.

The failure that actually sinks projects is the opposite. A scheme drawn too tightly stops people doing their jobs, and they do not escalate — they route around it. Copies appear in personal mailboxes, a spreadsheet gets kept on a laptop, a shared folder is created outside the system "just for this project", and within a quarter the company's real estate is less controlled than before the exercise began, while every dashboard reports full compliance. Nothing breaks loudly. That is precisely what makes it expensive.

A practitioner who understands this designs for the behaviour rather than for the diagram: as few tiers as the obligations allow, a documented route to get access rather than a wall, and a review after a quarter of real use whose explicit purpose is to find the workarounds. The scheme that survives is the one people can comply with while working at speed.

The buyer is answering an obligation, not pursuing an ambition

Almost nobody commissions this work out of curiosity. The signature is usually a general counsel, a compliance officer or a finance director, and the trigger is external: a customer contract that demands a described handling standard, a sector obligation the client has realised it cannot evidence, an acquisition where somebody has to state what is inside the target, a cross-border arrangement that requires knowing what would be moving, or a group parent asking a question the local company cannot answer.

That changes the sale from the one a technology vendor is used to. The client is not comparing features; he is trying to reach a position he can defend in writing. The practice that wins is the one that tells him plainly what the engagement will and will not let him assert at the end of it.

Price the discovery apart from the classification, because the estate is always larger than the client said

This is the single most useful commercial rule on the page. A client will name three systems. The engagement will find those three, plus a decade of shared drives, plus mailboxes, plus a departmental database nobody supports, plus the exports somebody has been keeping locally since a project in a previous role. A fixed fee quoted against an estate nobody has measured is how a practice funds a client's archaeology out of its own margin.

So the engagement is sold in two parts: a bounded discovery that produces an index of what exists and how much of it there is, and then a classification exercise priced against that index. The client gets a real number instead of an optimistic one, and the practice stops carrying a risk it has no way to assess. A second structural fee follows naturally, because a scheme decays as soon as the business changes, and a periodic re-reading of the estate is worth more to the client than the original project.

CZ 232 — Data Classification & Analysis

What the line covers is the discovery of what a company holds and where it holds it; the design of a tiered scheme with handling, access and retention rules for each tier; analysis of the catalogued material to show duplication, redundancy and concentration of exposure; mapping which systems and which third parties touch each tier; and advice on applying the scheme and on reviewing it once the business has been living with it.

The distribution in that drawing is the point. Three of the six steps are the client's own, and they are the three that carry authority: deciding what position is needed, adopting the scheme, and putting it into effect across systems the practice does not administer. A firm that promises to deliver all six is promising something it cannot perform, and the gap shows up at the moment somebody asks who approved the policy.

What the line does not make you, and it is four things

The trade licence with the activity recorded on it comes from the economic department of the emirate, and for work of this kind the licence is the straightforward part. What matters commercially is what the activity does not confer, because a client will assume more than it gives.

It does not make you the decision-maker. Whether the company may hold a category of information at all, on what basis, for how long and who may see it are the client's decisions, taken by someone with standing inside the client. The practice recommends a scheme and documents the reasoning; an officer of the company adopts it. An engagement letter that blurs this is writing a liability the practice cannot carry.

It does not make you the party answerable for the material. You handle it on instruction, for a defined purpose, for the duration of the engagement. The company remains answerable for what it holds. That boundary belongs in the contract alongside what you may copy, where you may keep it, and what is destroyed at the end.

It does not confer sector standing. Patient records, banking and payment records, education records and the books a taxable person must keep each sit under controls belonging to their own sector, and classifying them gives no right to use them for anything. Where an estate contains that kind of material, the retention and access rules are set by the obligation rather than by the scheme's own logic — which is why the tax record-keeping requirement often sets a floor underneath a deletion policy a client wanted to be more aggressive.

It is not data processing. CZ 235 sits nearby and the two get conflated. Classification describes records and sets the rules that govern them; processing acts on them, at volume, to produce an output the client uses. Describing a payroll file is this line. Running the payroll is the other one. A practice that drifts from the first into the second has changed what it is selling and should check that the licence still matches.

Because the clients are UAE companies and the estate being examined sits on their premises or in their tenancies, a mainland licence is the ordinary route; a free zone licence can hold the activity and suits a practice serving companies inside its own zone or clients abroad. What a given licence permits, and to whom, is settled by the authority issuing it rather than assumed from the activity name. What it costs to hold, which form it takes and what additional standing is needed for the parts this line excludes all depend on the emirate and the licensing authority, and ConsultZone establishes those for the specific practice before an application is made.

References

1. UAE Government portal — federal law and national strategy, including the UAE's position on personal data, which is what most schemes are drawn against. UAE Government portal
2. Federal Tax Authority — the records a taxable person is required to keep, which sets a floor underneath any retention or deletion rule. Federal Tax Authority
3. Dubai Health Authority — health facilities in Dubai, whose records sit under sector controls that a classification scheme has to respect rather than replace. Dubai Health Authority
4. Central Bank of the UAE — banking and payment services, the sector whose own supervision governs how its records are held and reached. Central Bank of the UAE
5. Ministry of Economy — company matters and the records a UAE company keeps about itself. Ministry of Economy