National Center for Archives and Records regulations
Classification plans, retention schedules and disposal procedures in our projects are built on the National Center for Archives and Records regulations, and we hand over approved, auditable procedure manuals. Our systems support a retention period per document, expiry alerts and a documented disposal log.
Personal Data Protection Law (PDPL)
- Identifying personal data in documents and classifying it within the classification plan.
- Least privilege: permission-based access and an audit log of every view or download.
- Confidentiality undertakings for field teams, and data processing inside the Kingdom.
- Procedures for data subject requests and breach response.
National Cybersecurity Authority (NCA) controls
- Systems can run on-premise or on a local cloud according to data classification.
- Encryption in transit and at rest, identity and permission management, and event logs.
- Scheduled backups and periodic restore testing.
- Security updates included in annual support contracts.
E-invoicing (ZATCA)
Mandatory e-invoicing turned the electronic retention of financial documents from an optional improvement into a regulatory obligation. Our archiving solutions help retain invoices, link them to transactions and retrieve them at audit time.
How compliance shows in our projects
| Stage | What we deliver |
|---|---|
| Assessment | Current compliance gap report and data classification |
| Design | Approved classification plan, retention schedules and permission matrix |
| Execution | Confidentiality undertakings, sample-based quality control, reconciliation reports |
| Operation | Audit log, disposal log, documented backups |
For a question about a specific regulatory requirement in your project, request a consultation.