English translation published by the NBR in its bilingual Regulations file (marked unofficial). The Arabic text published in the Official Gazette remains the legal reference in the event of any discrepancy.
A Taxable Person may appoint a third party to keep records and books under the Law and Regulations, but remains responsible for them in all cases.
Businesses using accounting firms, archive vendors, cloud providers or outsourcers.
Outsourcing does not transfer NBR responsibility. The contract should preserve prompt access, readable export, security, backup and delivery after termination or vendor dispute.
Current text
Vendor retention controls
- 1
Map records held by vendor and internally.
- 2
Guarantee on-demand access and export.
- 3
Specify format, period, security and backups.
- 4
Keep an independent copy or tested exit plan.
- 5
Run periodic deliveries before termination.
- 6
Do not treat private liability clauses as NBR release.
Connected provisions
Regulations — Article (101)
Required recordsVendor scope must cover the Person's required records.
Open connected ArticleRegulations — Article (102)
Electronic retentionAccess and security apply to vendor systems.
Open connected ArticleRegulations — Article (103)
Retention periodsContract end does not end the legal period.
Open connected ArticleOfficial guides and tools
Connected Madar tools
Accounting firm closed portal access
After contract termination, an accounting firm blocks old files. This does not excuse the business when the NBR asks for records; an export and handover plan should have existed because responsibility remained with the business.
Questions to help you apply it
- Who holds each record?
- Can we export independently?
- What happens on termination?
- Backup tested?
- Service covers full period?