# Digital Archiving in Saudi Arabia: The Paperless Office Guide
*Turn your office into a secure, fast, searchable environment using cloud technology*

> **In short:** How to run digital archiving in a Saudi business: statutory retention periods, in-Kingdom storage rules, e-invoicing conditions, and a cloud archive in Snad.

- **URL:** https://www.snad.io/en/blog/digital-archiving-guide-paperless-office-saudi
- **Arabic original:** https://www.snad.io/blog/digital-archiving-guide-paperless-office-saudi
- **Category:** Guides — Business & Inventory Management
- **Tags:** digital archiving, document management, digital transformation, record retention, paperless office
- **Published:** 2026-02-10
- **Updated:** 2026-08-02
- **Publisher:** Snad (snad.io)

Every company holds paperwork it is legally required to keep for years. That does not mean your office has to choke on files.

Done properly, digital archiving protects your rights and frees your space at the same time.

## The era of the crowded office is over

Are you still spending minutes, or hours, hunting for last year's supplier invoice in a stack of folders? With Vision 2030 pushing toward full digitisation, relying on paper is no longer simply an administrative slowdown. It has become a financial burden and a security risk. Digital archiving is not scanning documents and saving them on a computer. It is a complete system that protects business continuity and lets you retrieve any piece of information in seconds. Moving to the paperless office is the first step toward a professional operation.

## Why you should start digital archiving now

Traditional archiving eats office space you could use far better, and it carries the risk of losing data to damage, fire or simple misplacement. On top of that, the Zakat, Tax and Customs Authority (ZATCA) e-invoicing requirements impose long retention periods on your records, reaching 10 years in some cases. Digital archiving in Snad keeps those records safe, encrypted and reachable from anywhere at any time, with no physical storeroom involved.

## Snad as a smart cloud archive for your transactions

In Snad, archiving is not a separate feature. It is the core of the system.
1. **Sales and purchase archiving:** every invoice you issue or enter is saved automatically, along with every amendment made to it.
2. **Attachments:** you can photograph expense invoices, supplier contracts or receipt vouchers and link them directly to the financial transaction inside the system.
3. **Employee files:** instead of paper personnel files, you can upload copies of ID cards, iqamas and employment contracts into the HR module, with automatic alerts before they expire.

## Steps to a successful move to digital archiving

1. **Inventory and classify:** decide which documents you are legally required to keep and which can be destroyed. 2. **Use scanning tools:** rely on mobile apps, such as the Snad app, to scan invoices the moment they are issued. 3. **Name files consistently:** never save files under random names; use a naming convention that includes the date and the customer or supplier name. 4. **Train the team:** make sure every employee understands that a document that is not in Snad is a document that does not exist, so that digitisation becomes part of how the business works.

## Security and privacy in a digital archive

Some people worry about data breaches when they move to digital archiving. Snad uses global encryption protocols (SSL) and protected servers, so nobody reaches your data except through the specific permissions you grant. Automatic backup also protects you from data loss if your own computer fails, which paper archiving never does.

## Statutory retention periods: how long must each document survive?

Before you decide what to destroy, know the statutory period for each type. Article 66 of the VAT Implementing Regulations sets the minimum, and Article 52 sets the capital-asset adjustment period on which the longer periods are built.

| Document type | Minimum retention | When the period starts |
|---|---|---|
| Invoices, records and accounting documents | 6 years | End of the related tax period |
| Records of movable capital assets | 11 years (6 + 5) | Date the asset was acquired |
| Records of capital assets permanently attached to land or property | 15 years (10 + 5) | Date the asset was acquired |

Watch a point that many people miss: the six-year period runs from the **end of the tax period** the document relates to, not from the invoice issue date. And if the useful life of the capital asset under your accounting practice is shorter than the adjustment period, the adjustment period becomes that useful life, with any part of a year counted as a full year.

The Companies Law names no figure, but its Article 17 requires the company to keep its accounting records and the documents supporting them at its head office or at any other place designated by the company's manager or board. In other words, deciding where the archive lives is an administrative decision to be taken and documented, not a passing arrangement.

## The in-Kingdom storage condition and what changed in it

Paragraph (3) of Article 66 requires invoices, documents and records to be kept in the Kingdom, whether on paper or electronically, through access to the servers or databases in which they are stored via a terminal or a terminal connection located in the Kingdom.

The earlier wording was narrower: it required the computer system or the server to be physically located in the Kingdom. The paragraph was amended by ZATCA Board of Directors resolution No. (7-2-21) dated 9 November 2021. The practical test today is whether the data can be reached from inside the Kingdom, not the location of the hardware alone.

Paragraph (2) still stands: records must be kept in Arabic, and all invoices must be issued in Arabic in addition to any other language they are issued in. An archive built on English-only fields and labels creates a gap that surfaces during an audit, not before it.

## The conditions an electronic archive has to meet

If you choose electronic storage over paper, you are bound by specific conditions set out in paragraph (3) of the same article. Here is what they mean in operational terms:

| Statutory condition | What it means inside your system |
|---|---|
| Accessing invoices and documents and extracting them at the Authority's request | Immediate export in a readable format, with no wait on the vendor |
| Entering data in Arabic wherever possible, matching the copy in the books | Arabic fields inside the archive, not only in the interface |
| Keeping the original documents supporting the entries and producing them on request | Scanning does not by itself remove the obligation to keep the original |
| Documenting data entry and the system that processes accounting entries | A written manual explaining how a document enters and how it is linked to its entry |
| Auditable security procedures and controls that prevent tampering | Defined permissions, and a log showing who changed what and when |
| The Authority's power to review the systems and software in use | The system itself is open to inspection, not only your data |

The third condition matters most in practice: keeping the original documents that support every entry recorded in the accounting books, and producing them to the Authority on request. So do not build a paper destruction plan on the assumption that a digital image is enough in every case.

## What your system must not be able to do

In e-invoicing the equation flips: the value lies in what the system prevents, not in what it allows. The Controls, Requirements, Technical Specifications and Procedural Rules resolution No. (62738) dated 23/11/1443 AH requires the technical solution to protect issued invoices and notes against any amendment or deletion, and to store and archive them in the specified format without needing an internet connection. A solution is treated as non-compliant if it allows any of the prohibited functions:

- Access without a login, a default password, or no user session management
- Amending or deleting issued invoices and notes or their logs
- Incorrect time stamps, a log without sequencing, or resetting the invoice counter
- Creating more than one invoice or note sequence at any time
- Exporting or transferring the cryptographic stamp private key for use on another device
- Changing the time of the technical solution or altering time-stamp data during issuance

Review the [e-invoicing requirements](/zatca) before you adopt any archiving tool that handles issued invoices.

## Naming archive files: the rule is written down

Consistent naming is not an administrative preference. It has a stated minimum. The resolution requires the solution to be able to export invoices and notes to external archiving systems, and requires the exported file name to contain:

- The VAT registration number
- The date the invoice or note was issued
- The time of issuance
- The reference number of the invoice or note

Build your internal convention on the same order so the archive stays intelligible even outside your system, for example: `3xxxxxxxxxxxxx3_20260801_1435_INV-00842.xml`. Apply the same logic to non-tax attachments in [purchasing](/purchases) and [accounting](/accounting): a name that starts with the counterparty and then the date keeps the file findable years later, even after the employee who uploaded it has left.

## A readiness drill: assume the request arrived today

Do not discover the holes in your archive during a live inspection. Run a short quarterly drill:

1. Pick three random transactions more than three years old: a sales invoice, a supplier invoice and a capital asset.
2. For each one, pull out the electronic file, the original document supporting the entry, and the log of who created it or amended it.
3. Record how long it took. Any document that takes more than a few minutes to find means the classification needs a review.
4. Confirm that the extraction was done under a named person's permission, and that this permission still suits their current role.

Add a fifth item: which documents passed their statutory period this quarter? Take a written decision on each one instead of letting them pile up digitally the way they once piled up on paper. Document the drill steps on a single page, because that documentation is itself one of the conditions of Article 66, not merely good practice.

## Your archive answers to more than one authority

Most discussion of archiving stops at the Zakat, Tax and Customs Authority. But a single file can fall under more than one law at the same time, and each law follows a different logic: one sets a minimum period, another dictates language and location, and a third orders destruction.

| Law | What it imposes on your archive | Reference |
|---|---|---|
| The Commercial Books Law | Keeping books, correspondence and documents for at least ten years | Article 8 (Royal Decree M/61) |
| The VAT Implementing Regulations | Keeping invoices, records and accounting documents for at least six years from the end of the tax period | Article 66 |
| The Saudi Labor Law | Keeping records, files and employment contracts in Arabic, and holding them at the workplace | Articles 9 and 17 |
| The Personal Data Protection Law | Destroying personal data without delay once the purpose of collection has ended | Article 18 |

The rule when they conflict is simple: comply with the longer period, and never destroy a file because one law permits it while another still requires it. Watch the calendar difference too: periods under the Saudi Labor Law are calculated on the Hijri calendar unless the employment contract or the work regulations state otherwise (Article 10), while the six-year tax period starts from the end of the tax period the document relates to. A destruction schedule that mixes the two calendars produces silent errors, so use the [Hijri date converter](/tools/utilities/hijri-converter) when you build it.

## Commercial books: correspondence is part of the archive

The Commercial Books Law widens the circle of what has to be kept. Article 6 requires the merchant to keep a true copy of all correspondence and documents relating to the business, both outgoing and incoming, and to keep them in an orderly manner that makes it easy to review the accounting entries and to verify profits and losses when needed.

That means approving a purchase request by email, or agreeing a price change with a customer, is part of the archive rather than a passing message. Article 1 requires the books to be orderly and in Arabic, and exempts from keeping them any merchant whose capital does not exceed SAR 100,000. Article 2 permits the entries to be recorded by computer for establishments and companies that use one in their accounts, in line with the procedures and rules set by the Implementing Regulations.

In practice: link every document to the transaction that created it in [sales](/sales) instead of leaving it in an employee's inbox, because a personal mailbox is not orderly record-keeping in the statutory sense. Any violation of the law or its regulations carries a fine of no less than SAR 5,000 and no more than SAR 50,000 (Article 12).

## The weight of an electronic record: when does it replace paper?

The Electronic Transactions Law answers this question directly. Article 6 states that where any law in the Kingdom requires a document or piece of information to be retained for any reason, that requirement is satisfied by retaining or sending it as an electronic record, subject to three things:

- The record is retained in the form in which it was created, sent or received, or in a form that allows its content to be proven identical to the original content.
- The record remains stored in a way that allows it to be used and referred to later.
- The information that identifies the originator, the addressee, and the date and time of sending and receipt is retained.

Article 8 treats the electronic record as an original in its own right where technical means and conditions were used that confirm the integrity of its information from the time it was created in its final form, and that allow the required information to be displayed on request. Article 9 sets out what is considered when weighing that evidential value: the method used to create, store or communicate the record and the possibility of amending it, the method used to preserve the integrity of the information, and the method used to identify the originator. Which is why an amendment log and permission controls are not a technical luxury. They are the measure of what your archive is worth in a dispute.

The law has exceptions in Article 3: transactions relating to personal status, and the issuance of deeds relating to dispositions of real estate, unless the body responsible for them issues something permitting them to be carried out electronically under controls it sets.

## The other side: when does the law require destruction?

The Personal Data Protection Law overturns the comfortable assumption that storage is cheap so we may as well keep everything. The rule in Article 18, as amended by Royal Decree No. (M/148) dated 1444/9/5 AH, is that the controller must destroy personal data without delay once the purpose of collecting it has ended. Data may be kept after that if everything that specifically identifies the data subject has been removed, under the controls set out in the regulations.

| File status | The statutory decision |
|---|---|
| The purpose has ended and there is no legal ground to keep it | Destroy without delay, or remove whatever identifies the data subject |
| A legal ground requires retention for a defined period | Keep it, then destroy after the period ends or the purpose ends, whichever is longer |
| The data is closely connected to a case before a judicial body | Keep it until the judicial proceedings in that case are complete |

The operational impact is immediate: ID copies and customer data are not neutral files that live forever. Give every data type in [HR](/hr) a review date, and record the destruction decision, who approved it, and when it was carried out.

## Who owns the archive inside the business?

Article 19 of the Personal Data Protection Law requires the controller to take the necessary organisational, administrative and technical procedures and means to safeguard personal data, including when it is transferred. Describing those procedures as organisational and administrative means the obligation does not fall on the technology vendor alone.

| Role | What they own | What they do not own |
|---|---|---|
| Operations employee | Uploading the document and linking it to the transaction | Deleting a posted document or changing its date |
| Finance lead | Review and export on an official request | Approving destruction on their own |
| The owner, or a written delegate | Approving the retention schedule and destruction decisions | Overriding the statutory periods |

Add one item most businesses are missing: who notifies the competent authority when personal data is leaked, damaged or accessed unlawfully? Article 20 requires that notification in line with the regulations, and requires notifying the data subject if the event would cause damage to their data or conflict with their rights or interests. Write the name and contact number into the procedure today, not on the day of the incident.

## Frequently asked questions

### Does a digital archive legally replace the paper original?

For electronic tax invoices, the digital copy in the approved system is the original. For formal contracts, it is better to keep the paper copies alongside the digital archive as a precaution.

### How much storage do I get for my files in Snad?

Snad offers flexible storage capacities that scale with the size of your business, so you can upload all your day-to-day documents and invoices without worrying about running out of space.

### How many years must invoices and accounting records be kept in Saudi Arabia?

The minimum is six years for invoices, records and accounting documents, counted from the end of the tax period they relate to, under Article 66 of the VAT Implementing Regulations. Capital asset records are kept for the adjustment period set in Article 52 plus five years: 11 years for movable capital assets, and 15 years for assets permanently attached to land or property, with the period starting from the date the asset was acquired. Source: the Implementing Regulations published on the Zakat, Tax and Customs Authority website — accessed August 2026.

### Can a company's archive be stored on servers outside the Kingdom?

Paragraph (3) of Article 66 requires invoices, documents and records to be kept in the Kingdom, on paper or electronically through access to the servers or databases in which they are stored via a terminal or a terminal connection located in the Kingdom. Before the amendment, the wording required the computer system or the server to be physically located in the Kingdom; it was then amended by ZATCA Board of Directors resolution No. (7-2-21) dated 9 November 2021. The practical test is whether the data can be reached from inside the Kingdom on request.

### Can paper invoices be destroyed once they have been scanned?

Do not build a destruction plan on scanning alone. One of the electronic storage conditions in Article 66 is keeping the original documents that support every entry recorded in the accounting books and producing them to the Authority on request. The practical rule: archive digitally to speed up access, keep the originals supporting the entries for the full statutory period, and then take a written destruction decision for each batch once its period has expired.

### Which functions are prohibited in e-invoicing systems?

Under the Controls, Requirements, Technical Specifications and Procedural Rules for e-invoicing, resolution No. (62738) dated 23/11/1443 AH, a technical solution is treated as non-compliant if it allows: access without a login, a default password, or no session management; amending or deleting issued invoices and notes or their logs; issuing incorrect time stamps, a log without sequencing, or resetting the invoice counter; creating more than one sequence; exporting or transferring the cryptographic stamp private key; or changing the solution's time and altering time-stamp data.

### Which language must archived records be in?

Paragraph (2) of Article 66 requires records to be kept in Arabic, and all invoices to be issued in Arabic in addition to any other language the tax invoices may be issued in. Among the electronic storage conditions, data must be entered into the computer system in Arabic wherever that is possible, and must match the copy in the books exactly.

### How many years must commercial books and correspondence be kept?

At least ten years. Article 8 of the Commercial Books Law states that the merchant and their heirs must keep the books prescribed in the law, the correspondence, and the documents referred to in Article 6 for at least ten years. The law was issued by Royal Decree No. (M/61) dated 17/12/1409 AH and its status is in force. Any violation of its provisions or its regulations is punishable by a fine of no less than SAR 5,000 and no more than SAR 50,000 (Article 12). Source: the text of the law published on the Saudi laws portal — accessed August 2026.

### When is electronic storage enough instead of paper under the Electronic Transactions Law?

Under Article 6 of the Electronic Transactions Law, where any law in the Kingdom requires a document or piece of information to be retained for any reason, that requirement is satisfied by retaining or sending it as an electronic record on three conditions: the record is retained in the form in which it was created, sent or received, or in a form that proves its content matches the original; it remains stored in a way that allows it to be used and referred to later; and the information identifying the originator, the addressee, and the date and time of sending and receipt is retained. The electronic record is treated as an original in its own right where technical means and conditions were used that confirm the integrity of its information from the moment it was created in its final form and allow it to be displayed on request (Article 8). The law was issued by Royal Decree No. (M/18) dated 8/3/1428 AH. Source: the text of the law published on the Saudi laws portal — accessed August 2026.

### Does the Electronic Transactions Law apply to every document?

No. Article 3 of the law excludes two categories: transactions relating to personal status, and the issuance of deeds relating to dispositions of real estate, unless the body responsible for those transactions issues something permitting them to be carried out electronically under controls it sets in agreement with the Ministry. In practice: do not build a single archiving policy that assumes every document the business holds falls under the same rule. Source: the text of the Electronic Transactions Law on the Saudi laws portal — accessed August 2026.

### Can customer and employee data be kept indefinitely?

No. Article 18 of the Personal Data Protection Law — as amended by Royal Decree No. (M/148) dated 1444/9/5 AH — states that the controller must destroy personal data without delay once the purpose of collecting it has ended, and that the data may be kept after the purpose ends if everything that specifically identifies the data subject has been removed under the controls in the regulations. Retention is mandatory in two cases: where a legal ground requires keeping the data for a defined period, in which case destruction takes place after the period ends or the purpose ends, whichever is longer; and where the data is closely connected to a case before a judicial body, in which case destruction takes place after the judicial proceedings are complete. The law was issued by Royal Decree No. (M/19) dated 1443/2/9 AH. Sources: the text of the law on the Saudi laws portal, and the guideline on destroying personal data and anonymisation issued by the Saudi Data and Artificial Intelligence Authority — both accessed August 2026.

### Which calendar are document retention periods calculated on?

It differs by law. Article 10 of the Saudi Labor Law states that all periods and dates set out in it are calculated on the Hijri calendar, unless the employment contract or the work regulations state otherwise. The retention period for invoices, records and accounting documents for VAT purposes is at least six years, starting from the end of the tax period they relate to, under Article 66 of the Implementing Regulations published on the Zakat, Tax and Customs Authority website. Your retention schedule should therefore show which calendar applies to each row. Sources: the Saudi Labor Law on the Saudi laws portal, and the VAT Implementing Regulations on zatca.gov.sa — both accessed August 2026.

### What has to happen the moment a data breach is discovered in the archive?

Article 20 of the Personal Data Protection Law — as amended by Royal Decree No. (M/148) dated 1444/9/5 AH — requires the controller to notify the competent authority once it becomes aware that personal data has been leaked, damaged or unlawfully accessed, in line with what the regulations specify, and to notify the data subject if the event would cause damage to their data or conflict with their rights or interests. Article 19 requires the organisational, administrative and technical procedures and means necessary to safeguard the data, including when it is transferred. Source: the text of the law on the Saudi laws portal — accessed August 2026.

---
## About the publisher
**Snad (سند)** — a private Saudi software company
based in Riyadh, founded 2025. Legal form: Sole proprietorship.
Commercial registration: 7038154642
VAT number: 310959226500003
Only official domain: snad.io
> Snad is a private commercial business-management platform. It is not a
> government body, not a bank, and not a government services portal, and it
> is not affiliated with any government entity. Any site or app with a
> similar name is unrelated to Snad.