UAE Record Retention Rules: What Businesses Need to Know

One Transaction, Four Clocks

Ask a UAE finance team how long they keep records and the answer is usually a single number, often five years, sometimes seven, occasionally “we keep everything.”

Now take one transaction: a company buys a commercial unit, pays VAT on it, capitalises it, and signs a contract to do so. That single event generates a VAT record, a capital asset record, a real estate document and an executed contract. Each of those carries a different retention period, and the longest is three times the shortest.

A single blanket rule cannot be right for all four. Keep everything for five years and some obligations are unmet. Keep everything for fifteen and you are storing a decade of invoices nobody will ever ask for, in a drive nobody can search.

Most businesses discover this when a request arrives with a deadline attached, and the question stops being “do we have it” and becomes “can we produce it, in the right language, within the time allowed.”

This article is for the person who would have to answer that: a CFO, a financial controller, a compliance or operations manager. It sets out the periods as currently reported, explains what changed on 1 October 2026 about where records may be held, and covers what a document system has to do to pass a retrieval test rather than a storage one.

Techvaria is a Zoho implementation and consulting partner, not a tax adviser or auditor. Retention periods and their application to your records should be confirmed with the Federal Tax Authority or a qualified UAE adviser before you act on them.

What the Periods Actually Are

Two independent sources agree on the core structure. ClearTax’s UAE VAT record keeping guide sets out the VAT position by reference to Article 70 of the VAT Law. Vertix Auditing cites FTA Decision No. 04 of 2026 as the framework for VAT and corporate tax accounting records.

Per ClearTax, the records in scope for VAT include sales tax invoices, purchase invoices and expense receipts, credit and debit notes, VAT returns and FTA correspondence, the sales, purchase and general ledgers linked to VAT, and customs, shipping and export documents for cross-border trade.

Two further periods from elsewhere in the same compliance picture are worth holding alongside these. Electronic signature data carries a minimum retention period of fifteen years, as covered in our guide to electronic signatures under the new Civil Code. And transfer pricing documentation must be produced within thirty days of an FTA request, which is a deadline for retrieval rather than a period for retention, and arguably the harder of the two.

Stated plainly: the seven-year corporate tax figure and the reference to FTA Decision No. 04 of 2026 come from a single secondary source. Confirm both with your adviser before setting policy on them.

The Penalties

Per ClearTax, failing to maintain required records attracts AED 10,000 for a first offence and AED 20,000 for a repeat offence. Separately, failing to produce VAT records in Arabic when the FTA requests them attracts AED 20,000.

That last one deserves attention, because it is a records-system requirement that almost nobody designs for. It is not a translation budget. It is a question about whether your document set can be produced in Arabic on request, and the answer is usually discovered under time pressure.

What Changed on 1 October 2026

Ministerial Decision No. 197 of 2026, amending Ministerial Decision No. 243 of 2025 on the Electronic Invoicing System, took effect on 1 October 2026. Per Gulf Business and The National, the amendment removed the requirement that e-invoice and e-credit note records be stored inside the UAE. Records must still be retained for the period set under the Tax Procedures Law and provided to the FTA on request.

Read the two halves of that carefully, because the asymmetry is where businesses will go wrong.

What was relaxed: the location. For the e-invoice records in scope, in-country storage is no longer a stated requirement.

What was not: the obligation. The retention period is unchanged, and so is the duty to produce records to the FTA when asked.

A relaxation of where is easily misread as a relaxation of whether. It is not. If anything, freeing the location raises the importance of the retrieval question, because records distributed across international infrastructure are only as useful as your ability to find them.

Our guide to where your Zoho data is hosted covers the residency decision itself, which this amendment has made more open rather than less relevant. Client contracts, sector requirements and internal policy can all still point toward in-country hosting, and none of those changed.

Why Retrieval Is the Real Test

Storage is cheap and nobody is audited on it. What gets tested is production: the right documents, for the right period, in the right language, within a deadline.

Three features of the UAE position make that harder than it sounds.

The deadlines are short. Transfer pricing documentation within thirty days of a request. VAT records on request. Neither allows for a reconstruction project.

The language requirement is real and priced. AED 20,000 for failing to produce VAT records in Arabic when asked, per ClearTax. A document set that exists only in English is not automatically a problem, but it becomes one at the moment of request if nobody has thought about it.

The periods differ by document type, not by year. This is the structural issue. A retention policy organised by year (“2021 folder, 2022 folder”) cannot express a rule that keeps the real estate file for fifteen years and the routine purchase invoice for five. Expressing that requires documents to be classified by type, which is a structure decision made when the file is saved, not when the request arrives.

Most shared drives fail on the third point first, and the first two then become unanswerable in the time available.

Where Zoho WorkDrive Fits, and What It Does Not Do

Per Zoho’s own WorkDrive features page, the relevant documented capabilities are: Team Folders as shared spaces with role-based access for members and sub-folder level sharing; admin control of roles and access at both account and Team Folder level; external links with access permissions and expiration periods; unlimited version history with the ability to revert to any version or compare changes; a complete audit trail of Team Folder activity, filterable by activity type, with an activity timeline showing who changed files and when; access statistics summarising when a file was accessed; admin reports on members, Team Folders, files and space used; eDiscovery, which Zoho describes as finding every file created by anyone at any time in a WorkDrive account; and watermarks plus admin control over who can share externally.

Mapped to the problem:

Three Limitations, Stated Plainly

The documented retention settings preserve deleted files; they do not run a records schedule. Zoho’s features page describes admins setting a retention period for files in the trash, based on company policy, with users able to restore deleted files. Separately, Zoho’s eDiscovery and retention help (for organisations on Zoho Workplace Professional or Mail Premium) describes a WorkDrive retention period of 7 to 2,500 days for permanently deleted files, and holds that keep data needed for an investigation. Neither describes disposing of records at the end of a statutory period, and 2,500 days is less than seven years, shorter than the 10- and 15-year periods above. Building a retention policy in WorkDrive is therefore structure and process design, supported by admin controls, not a setting you switch on.

No compliance certifications are named on that page. If your clients or auditors require specific certifications, ask Zoho directly rather than inferring them.

It does not decide what to keep. Classification is a judgement about the document, and the system records the conclusion. Which period applies to which record is a question for your adviser.

Dubai and UAE Considerations

• Residency is now a choice for e-invoice records, not a requirement. That widens the options; it does not settle them. Client commitments, sector expectations and internal policy are unaffected by MD 197.
• Arabic is a retrieval requirement, not only a drafting one. Decide which document categories may need to be produced in Arabic, and whether your process produces them on request or assembles them under pressure.
• Free zone and mainland entities may hold different record sets. A group with both will have documents whose classification differs by entity, which argues for structure at entity level rather than one shared pool.
• Counterparty evidence is now part of the record. The October 2026 VAT changes introduced supplier due diligence as a condition of input tax recovery, covered in our guide to the input tax recovery changes. Bank confirmations and trade licence checks are documents with a retention life of their own.
• Long periods outlive software decisions. Fifteen years is longer than most platform choices survive. Ask how you would export a complete, structured archive with its metadata intact from any system you are considering.

Best Practices

• Classify by document type, not by year. It is the only structure that can express different periods.
• Write the retention schedule down, with the source for each period. “Real estate: 15 years” is a policy. “Real estate: 15 years, per [source], confirmed with our adviser on [date]” is a defensible one.
• Decide the Arabic question in advance for the categories most likely to be requested.
• Separate active working files from the retained record. Drafts and working copies do not need a fifteen-year life, and mixing them makes retrieval worse.
• Test retrieval, do not assume it. Pick a transaction from three years ago and try to produce the full document set in an hour.
• Keep the metadata, not just the file. Who signed, when, which version: the audit trail is part of what makes a record useful.
• Review the schedule annually, because the periods and the instruments behind them change.

Common Implementation Mistakes

• Applying one period to everything. Either wasteful or non-compliant, and usually both in different places.
• Reading the October amendment as a general relaxation. It addressed where e-invoice records sit, not whether they must be kept.
• Organising the archive by year. Makes period-specific disposal impossible without manual review.
• Treating retention as an IT task. Which period applies to which record is a finance and compliance judgement; IT implements it.
• Assuming the platform disposes of records for you. Zoho’s documented retention controls keep deleted files for a set time. Expiry at the end of a statutory period is a process you design.
• Leaving the Arabic requirement until a request arrives. It carries a stated penalty and no grace period.

An Illustrative Scenario

The following example is entirely fictional. It is not a Techvaria client, and the details are invented to illustrate the mechanics described above.

A Dubai group with a trading entity and a property-holding entity keeps its documents in a shared drive organised by department and then by year. The policy, as understood by the finance team, is to keep everything for five years and delete nothing in practice.

An FTA query arrives concerning a property acquisition made several years earlier. The request covers the purchase documentation, the VAT treatment and the supporting contract.

The purchase invoice is found quickly. The contract takes longer, because it was executed by a manager who has since left and the signed copy sits in an email thread rather than the drive. The version actually signed cannot be distinguished with confidence from two near-identical drafts stored alongside it. And a question about whether certain records can be produced in Arabic has no answer, because nobody has been asked before.

Nothing here suggests the group did anything wrong. Its problem is that it cannot demonstrate quickly what it did.

The remedy is structural rather than technical. Documents are reorganised by type (tax records, capital assets, property, contracts), with the retention period recorded against each category and confirmed with the group’s adviser. The executed contract becomes the record, stored with its audit trail rather than beside its drafts. Retrieval is tested on an old transaction before anyone external asks. And the Arabic question is answered for the two categories most likely to be requested.

The group does not keep more than before. It keeps the same material in a shape that can answer a question.

Where This Applies

• Real estate and property businesses, which carry the longest periods and the most documents subject to them.
• Groups holding capital assets, where the asset record and the VAT record run on different clocks.
• Businesses with related party transactions, where transfer pricing documentation must be produced within thirty days of a request.
• Free zone entities, which may need to evidence classification decisions as well as transactions.
• Professional services firms, where the engagement contract, the deliverable and the billing record all have separate lives.

Implementation Guidance

1. Build the retention schedule first. Document categories, the period for each, and the source. Agree it with your tax adviser rather than with your IT team.
2. Inventory what you hold and where. Shared drives, email, local machines, the accounting system. Most of the risk is in the places nobody listed.
3. Design the folder structure around document type. Entity, then category, then period, so retention is a property of location.
4. Separate the record from the working file. Decide what constitutes the retained version and store it apart from drafts.
5. Set permissions deliberately. Who can add to the record, who can only read, who can share externally. Team Folder roles and sub-folder sharing support this.
6. Decide the Arabic position for the categories most likely to be requested, and document the process.
7. Migrate in order of risk, not of convenience. The oldest long-period records first, because they are the ones you cannot recreate.
8. Test retrieval against a real past transaction, with a stopwatch.
9. Define the disposal process. What happens at the end of a period, who approves it, and how a hold is applied when a dispute is live. This is process, not a setting.
10. Review annually, and whenever an instrument changes. For businesses consolidating from several systems, the data preparation is the real work. Our Zoho migration services page covers how those projects are scoped.

Approaches Compared