How We Kept a Healthcare Institution's NDMO Compliance Program on Track Through a Client Team Turnover

The situation

The client is a major healthcare institution holding large volumes of highly sensitive patient, clinical, and research data. National regulation required alignment with Saudi Arabia's National Data Management Office (NDMO) framework, and that framework is prescriptive: its Data Management and Personal Data Protection Standards define fifteen data management domains, data classification, data quality, and personal data protection among them, and alignment means demonstrating consistent governance, accountability, and compliance across all data domains. For a healthcare institution, falling short is not abstract. It means findings on the regulatory record and remediation under regulator scrutiny, while clinical operations keep running on the very data in question.

Healthcare made the problem harder in both directions. Clinical operations demanded strict control over data access, classification, and lifecycle management, while the institution's research activity introduced variability, cross-functional usage, and a wide circle of stakeholders. The institution launched a structured four-track transformation program in response: tracks 1 and 2 to establish the gap assessment, governance baseline, early policies, and operating model, and tracks 3 and 4 to carry configuration and implementation.

Then, with tracks 1 and 2 complete, the client's core project team was replaced. The turnover reset institutional understanding of everything delivered so far.

The regulator's clock did not stop for the turnover.

The challenge

The engagement absorbed regulatory complexity and organizational disruption at once:

1. Revalidation and revision of everything already delivered after the core client team turnover.
2. Continuous stakeholder alignment in an environment where governance must fit real medical workflows, not just frameworks.
3. Mandatory alignment with NDMO requirements across rapidly growing volumes of sensitive healthcare data.
4. The usual starting deficits: no standardized data management practices, no defined ownership or stewardship roles, and limited centralized visibility into compliance and governance performance.

Left unmanaged, the transition risked fragmenting the governance effort, eroding compliance readiness, and leaving standards inconsistently adopted across critical healthcare domains.

The approach

ExeQut treated the disruption as a scheduling problem to engineer around, not an unrecoverable loss. It is the same continuity discipline we apply in project rescue work: revalidate, re-document, and use the pause to get ahead.

Deliver the foundation

Tracks 1 and 2 completed the NDMO gap assessment, measuring existing practice against the framework's domains, and delivered the governance baseline: early-stage policies and initial operating model structures. Delivery ran as a joint governance structure between ExeQut and the institution's data governance stakeholders, with cross-functional participation from clinical, research, and IT departments. By design this was the foundation half of the program, and the foundation is exactly what a leadership turnover puts at risk.

Re-baseline after the turnover

When the client team changed, ExeQut re-engaged the new stakeholders and reassessed the governance assumptions under everything previously delivered, through revalidation workshops, structured documentation control, and regular governance sessions across the disrupted phases. The revision was not a cover-sheet exercise, and it carried a real schedule cost we accepted: carrying forward deliverables the new stakeholders had never validated would have meant building the implementation tracks on unverified assumptions. Every document was then standardized to the new organizational structure, so the paper trail matched its new owners.

Revalidation surfaced accountability gaps in the stewardship model; closing them left it stronger than the original.

Convert the pause into acceleration

The same period did double duty. While earlier deliverables were under revision, ExeQut pre-designed and structured tracks 3 and 4, so that once alignment stabilized the program could move directly into configuration and implementation instead of returning to planning.

Make governance legible to clinicians

Targeted workshops taught data governance in the language of healthcare, not abstract policy. Stewardship roles were mapped to clinical and research domains with distinct ownership across each, classification and lifecycle procedures were standardized to those workflows, and a policy and standards framework covered data access, usage, and retention, with compliance workflows built into the finalized governance model.

Put compliance status in front of executives

Centralized dashboards, backed by a structured compliance reporting framework, now give executives a single view of NDMO compliance status and governance performance across the enterprise, closing what had been a stated, unmet reporting need.

The outcome

A mid-program reset like this often derails transformation efforts. This one did not, and that is the return. The gap assessment, the early policies and framework components, and the stakeholder alignment underneath them, the entire delivered half of the program, were preserved at the cost of a revision cycle rather than a rebuild, and the remaining tracks start at configuration and implementation rather than at planning.

A restart would have meant paying twice for the first half of the program, while the compliance obligation stayed active.

The institution now holds:

• A deliverable set the incoming stakeholders have validated end to end, standardized to the current organizational structure.
• A standardized enterprise data governance framework with defined ownership, stewardship, and accountability across clinical and research domains.
• Standardized classification and lifecycle procedures, and a policy framework covering data access, usage, and retention for sensitive healthcare and research data.
• NDMO compliance readiness strengthened across enterprise data domains and positioned for ongoing and future audits.

These are foundation-layer outcomes by design: the framework, the operating model, and the visibility. What was left behind is an operating capability, not a binder, and the institution runs it: stewardship roles carry defined ownership, regular governance sessions maintain continuity, and embedded training means the teams handling the data understand the requirements they now own. The remaining tracks extend that foundation into configuration and implementation, including integration with clinical data platforms and the data quality and lifecycle work the framework already anticipates.

What we took from it

1. Write documentation for your successors. Governance outputs that assume institutional memory do not survive stakeholder turnover; adaptable, self-explanatory documentation does.
2. Revalidate after every ownership change. Walking new stakeholders through prior deliverables is cheaper than discovering misalignment during an audit.
3. Use transitions as design time. Pre-building the next program phases during a stakeholder reset turns disruption into schedule advantage.
4. Teach governance in the domain's language. Clinical teams adopt data governance when it maps to their workflows, not to a regulator's diagram.
5. Track-based structure is resilience. A program divided into discrete, self-contained tracks can absorb organizational shocks that would break a monolithic plan.