Secure and organised data: where it lives, how many copies exist and a ten-question check

Business data is worth only as much as you can protect, find and produce. If it sits in five unconnected places, it leaks, goes stale, or cannot be found when a regulator, an auditor or a customer asks. Secure means controlled access and a copy you can restore. Organised means one record of each thing.

What changed. 19 October 2026: the UAE Ministry of Finance announced Ministerial Decision No. 197 of 2026, in force since 1 October 2026. The Ministry says the amended Article 11 removes the requirement to store UAE e-invoice data inside the UAE; the duty is to keep it for the legal period and produce it on request. Other rules, such as a sector regulator's or a contract, may still set a place. Checked on 5 November 2026.

Two ways data loses its value

Data loses value in two ways, and most companies guard against only one.

• It leaks. Someone who should not see a salary, a price list or a customer's contact details does. The cure is access by role, a log of who did what, and a plan for the day it goes wrong.
• It cannot be found or trusted. The same customer is in the sales list, the accounting list and a spreadsheet, each with a different phone number and tax number. Nobody knows which is right, so nobody can answer a data request, an invoice query or an audit without a week of copying.

The second loss is quiet, which is why it lasts. A leak makes the news; a duplicate customer only makes every report a little wrong.

Organised means one record of each thing

Take one customer who also supplies you. In many companies they exist as two records: a customer in the sales system, a supplier in purchasing, plus a row in a spreadsheet. A change of tax number reaches one of them.

Organised does not mean everything in one database. It means one owner for each kind of record and the other systems pointing to it.

Where your data may live: the UAE and Saudi Arabia

Four sets of rules touch where business data sits. None of them is a replacement for your adviser's reading of your own case.

For Saudi Arabia, the Essential Cybersecurity Controls (ECC-2:2024) of the National Cybersecurity Authority (NCA) apply to government agencies, their affiliates and private operators of Critical National Infrastructure; the NCA strongly encourages others to use them as best practice. Other NCA frameworks, sector regulators or a customer's contract may still bind you or your vendor. The controls include backups that cover critical assets, quick recovery and periodic testing of recovery. If your customer is in scope, expect questions on both.

The UAE storage change above concerns UAE e-invoice data only; it does not carry over to Saudi Arabia, which has its own transfer rules for personal data. A draft amendment on in-Kingdom storage was published for comment when we wrote about it, so check its status before you rely on it. We read the draft in Saudi PDPL draft rules: in-Kingdom storage and what to map.

A ten-question self-check

Answer yes or no. One point for each yes.

1. Can you list every system that holds customer or employee personal data, and the country each runs in?
2. Does each customer and supplier exist once, in one register that sales, accounting and support all use?
3. Is access given by role, so a person sees only what their job needs?
4. Can you see who changed a record, when, and what it said before?
5. Is there a daily backup stored apart from the system, and have you restored from it in the last 12 months?
6. Do you know how long each kind of record must be kept, and who removes what is past its period?
7. Could you produce an invoice and its data for the tax authority within a few days?
8. If a customer asks for their data or its deletion, do you know who answers and by when?
9. Does the contract with every provider that holds your data say where it is stored and how you get it back when you leave?
10. Is there a written plan for who decides, and who tells whom, if data leaks?

How Tarleaks helps

The Security app keeps a personal-data audit log, and each company has its own database with a change history that records old and new values. Daily backups go to the company's connected storage and are kept 30 days. Our security page lists four places your data can live. Parties keeps each customer and supplier once and sends possible duplicates to a person to review. This is evidence for your assessment, not a certification.

What to do next

• Read why Tarleaks is built in Rust for how one database per company and the audit trail work.
• Using the UAE e-invoicing system? The 2026-2027 timeline lists the dates for your company.
• Book a demo and we go through your score and the data-location options together.

Questions people ask

Does the UAE require my business data to be stored inside the country?

Not for e-invoice data, according to the Ministry of Finance announcement of Ministerial Decision No. 197 of 2026: you must keep it for the period in the Tax Procedures Law and produce it to the Federal Tax Authority on request, wherever it is stored. Personal data has its own transfer requirements under the UAE PDPL, and a sector rule or a customer contract may still set a place, so ask your adviser.

What does secure and organised data mean for a business?

Secure means access is limited by role, changes are logged, and a backup you have restored exists. Organised means each customer, supplier and invoice exists once, with a known owner, a known place and a known retention period. A business that has both can answer a regulator, an auditor or a customer quickly.

Do I have to follow the Saudi National Cybersecurity Authority (NCA) Essential Cybersecurity Controls?

The controls themselves apply to government agencies, their affiliates and private entities that own, operate or host Critical National Infrastructure. The National Cybersecurity Authority (NCA) strongly encourages other entities to use them as best practice. Other NCA frameworks, sector regulators or your customer's contract may still bind you or your vendor, so ask your adviser.

How long must UAE e-invoice data be kept?

The period in the Tax Procedures Law. The Ministry's Guidelines v2.0 read it, for a VAT-registered business, as 5 years after the tax period, plus 4 more years in a dispute with the Federal Tax Authority or an audit. Other periods apply to businesses that are not VAT-registered and to real estate records. Using a provider to store the invoices does not move the duty to you.

Where does Tarleaks store data?

You choose among four options listed on our security page: our cloud with a database for your company, your own storage bucket, your own database, or your own servers. The location of our cloud is not published there yet, so ask us in a security walkthrough.

---

General information, not legal advice. Checked against the official sources listed on this page on 5 November 2026. Confirm your own position with the authority or your adviser.