Client Data Retention — MENA Jurisdiction Rules

Client Data Retention — MENA Jurisdiction Rules

When to use this

Apply when:

• Configuring automatic data-deletion or anonymization schedules for an eFirm tenant in a MENA jurisdiction.
• A lawyer asks how long they must keep client files.
• Responding to a client request to delete their data — does a legal-hold override apply?
• Auditing compliance with AML record-keeping obligations.
• Advising an in-house legal team on their document-retention policy for a MENA operation.

Minimum retention periods by jurisdiction

Saudi Arabia (KSA)

Practical note: the 5-year matter-file period is a professional minimum; some contracts or regulatory contexts require longer periods. CDD (Customer Due Diligence) records under AML rules must be kept for 10 years from the end of the business relationship.

United Arab Emirates (UAE — Federal / Onshore)

DIFC note: for DFSA-regulated firms within DIFC, AML records must be retained for 6 years. Client files should be retained per the engagement letter, but minimum 5 years is the safe standard.

ADGM

Lebanon

Practical note: Lebanon does not have a comprehensive personal-data-protection law as of May 2026. The retention obligations derive from bar rules and sector-specific AML legislation. Law 44 of 2015 (AML) and the associated Circular of the Banking Control Commission set the AML record standard.

Egypt

Bahrain

End-of-retention procedures

When the retention period has elapsed:

1. Anonymize, then delete (preferred over hard-delete): anonymize the data (remove all direct and indirect identifiers) rather than immediately hard-deleting. This preserves aggregate matter data for conflict-checking history and statistical use while removing personal exposure.
2. Confirm no legal hold: before any deletion or anonymization, check whether the matter or client is subject to a legal-hold order (litigation hold, regulatory investigation, tax authority inquiry). If yes, the hold overrides the standard retention clock.
3. Client request for early deletion: honor where permitted by law; document the request and the action. Note that professional obligations (AML, bar rules) may prevent full early deletion even when requested.
4. Tax records: retain for the jurisdictionally required period (typically 5–10 years) regardless of other matter closure.

Legal-hold override

A legal-hold flag in the matter management system overrides all automatic deletion and anonymization schedules. Legal holds are triggered by:

• Notice of litigation or regulatory investigation involving the matter.
• Court order or regulatory request to preserve records.
• Internal assessment that the matter may become contentious.

The hold remains in force until explicitly released by the matter's supervising lawyer. Release of a legal hold should be documented.

Platform behavior

The platform provides:

• Configurable retention period per matter: set at tenant onboarding or per-matter by the supervising lawyer.
• Automatic anonymization trigger: at the retention threshold, the system flags the matter for review and anonymizes upon confirmation.
• Legal-hold flag: set per matter; prevents auto-deletion; surfaced in matter dashboard.
• Client deletion request workflow: generates a deletion/anonymization confirmation with legal-hold check.

Common mistakes

• Treating the matter-close date as the retention start: the retention period typically runs from the end of the client relationship or last transaction, not from when the file was opened.
• Forgetting AML retention is longer: AML/CDD records in most MENA jurisdictions have a 10-year (KSA) or minimum-5-year (UAE, LB, EG) obligation — longer than general matter-file periods.
• Hard-deleting too early: early hard-deletion that violates professional retention rules could expose the firm to regulatory sanctions; anonymization is safer and usually sufficient.
• Ignoring tax records: tax records have their own retention clocks and may extend beyond both matter-file and AML periods.

Related skills

• [[safety-client-confidentiality-cross-tenant]] — cross-tenant isolation and data segregation
• [[safety-cross-border-data-transfer-gcc-eu]] — cross-border transfer requirements for retained data
• [[safety-bar-rule-1-6-confidentiality-ai]] — confidentiality obligations for AI tool use
• [[safety-pii-redaction-before-rag]] — PII handling before external processing
• [[review-compliance-gap-analysis]] — gap-analysis workflow for compliance reviews