• 2/ 1 Records and data related to electronic transactions must be preserved in accordance with the requirements of any laws, regulations, or procedures related to the preservation of traditional records and data, without prejudice to Article Five of the Law.

• 2/ 2 Records that are inherently issued must be preserved with all their original data, and they may be stored (archived) in any form of electronic data that does not compromise the content and integrity of the record.

• 2/ 3  Subject to the provisions of the previous paragraph (1/2) of this Article, the electronic record must include data that identifies the record, its connection to the electronic transaction, and other electronic records. This data must include the following elements as a minimum:

  • 1. Information about the creator of the electronic record.

  • 2. Information about the sender of the electronic record, if different from the creator.

  • 3. Information about the recipient of the electronic record.

  • 4. The transaction number included in the electronic record and its nature.

  • 5. The date and time of the creation of the electronic record.

  • 6. The date and time of the sending of the electronic record.

  • 7. The date and time of the receipt of the electronic record.

  • 8. Information regarding retransmission, modification, or cancellation, as well as acknowledgment of receipt messages if required by the sender.

1/3 To determine the person obligated to maintain an electronic record, the relevant regulations, bylaws, and decisions related to the preservation of documents concerning the subject of the electronic record shall apply.

2/3 The person obligated to maintain the electronic record may utilize the services of another party to meet the preservation requirements, without affecting his responsibility as stipulated in this article.

3/3 The parties to the electronic transaction are bound by the bilateral agreements concluded between them regarding the preservation of electronic data and the protection of its privacy, provided that this does not conflict with the relevant regulations.

• 1/4 Records and data related to any electronic transaction must be preserved in accordance with the requirements of any systems, regulations, or procedures related to determining the time periods during which the records and data must be retained.

• 2/4 Subject to the provisions of the previous paragraph (1/4) of this article, records and data related to any electronic transaction must be preserved in accordance with the requirements of the following documents:

  • 1. Agreements concluded between the parties to the electronic transaction.

  • 2. The regulations and procedures governing the operation of the center.
     

• 1/5 When storing electronic records and data, the following conditions must be met:

  • 1. Adherence to clear and documented rules and procedures for storing electronic records.

  • 2. Storing electronic records and data in any format that is consistent with the law applicable to the party performing the storage.

  • 3. Following clear and documented rules and standards to ensure the integrity of the stored electronic records from unauthorized access and modification, which should include application, revision, and disaster recovery plans.

  • 4. If any provision in this regulation requires the specification or preservation of the date and time, the following must be adhered to as a minimum:

    • أ) The date must be specified according to the Gregorian calendar at a minimum, with the addition of the Hijri calendar if required by any legal text, and the time must be specified to the hour, minute, and second at a minimum.

    • ب) The date and time must align with the official time approved by the center, unless the parties agree otherwise.

  • 5. To prove the accuracy of the time, the record must contain the timestamp approved by the center (as stated in the regulation of rules and procedures governing the center's work), or any timestamp explicitly agreed upon by the parties involved in the electronic transaction.

  • 6. Use appropriate technologies to ensure that the electronic record is preserved in the same form in which it was created, sent, or received, or to ensure that its content matches the content as it was created, sent, or received.

• 2/5 The party obligated to store electronic records must conduct archiving and backup operations periodically, ensuring the rights of those relying on these records.

• 1/6 It is required for the presentation of records and electronic data that the information related to electronic transactions is available in a standard electronic format that is readable, understandable, and complete.

• 2/6 Entities that store electronic records and data are obligated to define the access and handling permissions for the electronic records and data, and they commit to ensuring that all their affiliates adhere to the standards related to privacy protection. Access to the information and data pertaining to the parties involved may only be granted to the employees responsible for providing services, and only when necessary.

• 3/6 Entities that store electronic records are required to implement appropriate technical solutions to record all instances in which access to those electronic records occurs, or when they are accessed, modified, or altered in any way.

• 4/6 Either party in an electronic transaction or any legally authorized entity has the right to obtain information from the records related to the electronic transaction from the entities that store them. Conversely, the entity that stores the electronic records is not permitted to provide them to any third party without prior agreement between the parties involved in the transaction.