I believe by stating privileges you are further defining the definition of the data by being more specific about who or what can access that data. It is DDL!