HR Electronic Records

Legal Framework for Electronic Archiving 

Although some countries require certain types of documents to be kept and archived in their original paper form, for most categories of documents, including HR-related records, there is no such requirement, and it is generally acceptable to use electronic versions of paper records (i.e., scanned copies of paper originals) during most government agencies’ inspections and audits or in court proceedings.

The evidential or probative value of electronic versions of paper records may be more easily challenged before a court than it would be for the originals. This is mainly because the original records could be tampered with or changed before being scanned, and, unless proper technology has been used (e.g., encryption and timestamping), it may not be easy to detect such changes from a scanned copy. In specific situations, it may be good practice for employers to retain archives of paper originals in the event such originals would be requested by a specific investigator,  auditor, judge or authority. 

Are electronic scanned copies of paper originals legally valid?

Royal Decree No. M/18/1428 concerning the Electronic Transactions Law (ETL), dated March 26, 2007 (as amended) sets the foundation for electronic recordkeeping in Saudi Arabia. Under the law, electronic transactions, records and questions cannot be denied validity and enforceability on the grounds that they were wholly or partially conducted via electronic means, as long as they follow the requirements under the Law (Art. 5-1). Under the ETL, individuals cannot be required to use electronic transactions without their implicit or explicit consent.

Under the ETL (Art. 6), electronic records must be stored "in the form it was generated, sent, or received, or in such form that the contents thereof may be verified as being identical to the contents in which it was generated, sent or received.” Scanned copies of paper originals may be considered valid if the data in the record can be verified by supplying the original document, if necessary. Saudi judges have significant discretion to interpret laws and do not necessarily need to follow previous judgements. Therefore, Saudi employers retain the original version of key employment records, in addition to any electronic copies in case the validity of a record is questioned.

 

Are there any legal requirements for electronic archiving systems (EAS)?

When there is a legal requirement to store records, they can be retained electronically as long as the following requirements are met (ETL, Art. 6):

• The electronic record is stored in the form it was generated/sent/received or in a form that allows the contents of the record to be verified as being the same as the original;
• The record is stored in a way that allows for future use and reference;
• The electronic record includes data on the originator, addressee and the date and time the record was sent/received.

Electronic transactions, records and signatures remain in effect and enforceable, provided that they were executed in accordance with ETL, and as long as the details in the record can be accessed within the electronic data system of the originator of the record, and it’s clear how the record can be accessed.

In addition, the ETL Regulations (Art. 5.1) provide that when saving electronic records and data, certain requirements must be met:

• Clear and documented rules and procedures should be in place for saving electronic records;
• Saving electronic records and data must commensurate with the system used by the individual who performed the saving process;
• Clear and documented rules and standards should be in place to ensure electronic records aren’t vulnerable to unauthorized access and modification. Rules should include application, refinement and recovery plans in case of disaster;
• When date and time are required to be set/saved/highlighted, at minimum the following obligations are met: (a) Date should be set to the Gregorian calendar at least, with the addition of the Hijri calendar, if required by law, and time should be set by hour, minute and second at minimum; (b) date and time should correspond to the official time approved by National Center for Digital Certification (NCDC), unless parties agree otherwise.
• To verify the time, records should contain a time stamp approved by the NCDC, or a time stamp expressly agreed to by parties to the transaction; and,
• Appropriate techniques should be used to ensure electronic records are saved in the same form they were generated, sent or received, or in such form that the contents may be verified as being identical to the contents in which they were generated, sent or received.

The party required to save electronic records must conduct archiving and back-ups periodically.