Zasio
Contact our experts

News & Insights

Saudi Arabia Records Retention Requirements

· 4 min read

Recordkeeping and Information Governance in Saudi Arabia: Jurisdiction Overview

  • Jurisdiction official name: Kingdom of Saudi Arabia (Al-Mamlakah al-‘Arabiyyah as-Su‘ūdiyyah).
  • Legal system type: Islamic (Shari‘ah) law system supplemented by an expanding body of royal decrees, statutory regulations (anzimah), ministerial resolutions, and regulator rulebooks. Codification has accelerated in recent years, most notably through the Civil Transactions Law, the Companies Law, and a restructured commercial court system.
  • Primary language(s) of law/government: Arabic.
  • General Description of RIM landscape: Saudi Arabia’s recordkeeping rules are built on a 10-year commercial books baseline and additional tax, labor, social insurance, anti-money laundering, data protection, and cybersecurity requirements. For many records, organizations must consider duration, location, language, and system controls. Core tax records generally must be maintained in Saudi Arabia and in Arabic, while cybersecurity and cloud rules may require certain critical systems or classified government data to remain on Saudi-hosted infrastructure.

Zasio Research Scope & Depth

Total Zasio citations captured: 790

Primary sources relied upon:

  • Law of Commercial Books
  • Companies Law
  • Value Added Tax Law and its Implementing Regulations, including the E-Invoicing Regulation (ZATCA)
  • Labor Law and its Implementing Regulations
  • Social Insurance Law
  • Anti-Money Laundering Law and its Implementing Regulation
  • Personal Data Protection Law and its Implementing Regulations
  • National Cybersecurity Authority controls (Essential, Critical Systems, and Cloud Cybersecurity Controls)
  • Sector rulebooks and guidance issued by the Saudi Central Bank (SAMA), the Capital Market Authority (CMA), the Saudi Food and Drug Authority (SFDA), and the Communications, Space and Technology Commission (CST)

Core Recordkeeping Obligations

  • How long must businesses keep accounting records? Generally, at least 10 years for commercial books together with the correspondence and supporting documents issued or received in the business (Law of Commercial Books).
  • How long must employers keep personnel records? There is no single defined retention period. Employers must maintain a work file for each worker, plus wage, attendance, fines, training, and medical examination registers, at the workplace throughout the employment relationship (Labor Law and its Implementing Regulations). After separation, the practical floor is driven by potential ongoing liabilities.
  • Industries most heavily regulated:
    • Banking, finance companies, and capital market institutions
    • Insurance
    • Pharmaceuticals, medical devices, and health services
    • Energy, petrochemicals, and mining
    • Telecommunications, cloud, and data center services
    • Construction, engineering, and giga-project contracting

Other notable retention timeframes

  • VAT records: generally, 6 years from the end of the relevant tax period, 11 years for movable and intangible capital assets, and 15 years for immovable capital assets. Records must be kept in Arabic and within the Kingdom, either physically or through access to the server on which they are stored (Article 66, VAT Implementing Regulations).
  • AML/CFT records: at least 10 years; for transaction records from the date of the transaction, and customer due diligence records, account files, and business correspondence from the date the account is closed. Records tied to an open investigation or suspicious transaction report are held until the matter is confirmed closed.

What makes this jurisdiction interesting

Saudi Arabia is a jurisdiction where recordkeeping often depends on more than retention period alone. VAT and Zakat records generally must be kept in Saudi Arabia and in Arabic. Cloud and cybersecurity rules may also affect where certain systems and classified government data can be hosted.

Why this jurisdiction matters

Saudi Arabia is the largest economy in the Middle East, a G20 member, and a major regional investment hub under Vision 2030. The Regional Headquarters Program has encouraged many multinationals to establish licensed entities in Riyadh to compete for government contracts. Those entities must account for Saudi retention, residency, and Arabic-language requirements. At the same time, the PDPL became fully enforceable in September 2024.

How this research supports clients

Zasio’s Saudi Arabia research gives records, privacy, and compliance teams a defensible basis for retention schedules that reconcile the 10-year commercial baseline, the tiered 6, 11, and 15-year VAT periods, the 10-year AML floor, and the PDPL’s duty to destroy personal data once its purpose ends.

Disclaimer: The purpose of this post is to provide general education on records management and information governance topics. The statements are informational only and do not constitute legal advice. Any references to legal or regulatory recordkeeping requirements are provided for general guidance purposes and may not reflect all obligations applicable to your organization. Additional or alternative requirements may apply based on your organization’s industry, jurisdiction, risk profile, and specific business activities. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.