Every rule has a date.Be ready before it.
ZATCA e-invoicing, PDPL privacy, Qiwa, Mudad and GOSI, Saudi hosting and the RHQ rules. Smart Independent Technologies Company (SITCO) builds each requirement into the systems you already run, so fines, rejected invoices and blocked payroll never reach your desk.
Compliance register| Rule | What it asks | When |
|---|---|---|
| ZATCA Phase 2Wave 25 | Integrate with FATOORA | by 1 Feb 2027 |
| PDPLSDAIA | Report a breach to SDAIA | within 72 hours |
| Qiwa, NitaqatHRSD | Contracts documented on Qiwa | since 15 Apr 2026 |
| HostingSDAIA | Personal data sent abroad | only under conditions |
| RHQMISA | Start mandatory activities | 6 months from licence |
ZATCA Phase 2
Phase 2 e-invoicing, done properly.
A rejected invoice is a payment that waits. A system that is not connected to FATOORA by your wave's date is a violation. We connect yours, from diagnosis to the first cleared invoice.
ZATCA connects companies in waves. The last one is probably yours.
Each wave lowers the revenue threshold. The largest companies started in 2023. Now the line has reached SAR 187,500. Scroll to watch it fall.
8 of the 25 waves, each from its own ZATCA announcement. The vertical scale is logarithmic.
What clearance means. Five steps, in seconds.
- B2BA standard tax invoice is cleared by ZATCA before your buyer receives it.
- B2CA simplified invoice is reported to ZATCA within 24 hours.
- PIHEach invoice carries the hash of the one before it, so the chain cannot be edited quietly.
- QREach invoice carries a QR code with its key details and stamp.
What a slip costs. Fines start here.
These are the starting fines from Phase 1, and they rise with every repeat. The bigger cost is usually the customer payment that waits for a cleared invoice.
Source: ZATCA, e-invoicing violations and fines, 16 Nov 2021What we deliver.
- ✓A readiness reportInvoice types, systems, data gaps and your wave.
- ✓CSID onboardingFor every invoicing unit, from certificate request to production.
- ✓UBL 2.1 XMLWith the cryptographic stamp, hash chain and QR code.
- ✓Clearance and 24-hour reportingWith a rejection queue and alerts, so nothing slips.
- ✓Connected to your systemOracle, APEX or a custom ERP, or a standalone app. No replacement needed.
PDPL privacy
Privacy built into your systems, not a PDF.
Every form on your website, every WhatsApp chat and every employee file holds personal data. The law has been fully enforceable since 14 September 2024.
Five obligations. Something we build for each.
The law asks for an outcome. We build the tool that proves it, inside the systems you already run.
Article 12Privacy notice
A privacy policy available before you collect data: purpose, data, storage, destruction, and how people use their rights.
A bilingual notice, written with your legal counsel and linked from every form.
Law and regulationConsent
Consent you can prove: who agreed, to what, and when, with a way to withdraw.
Consent capture and logs on your website, WhatsApp and CRM.
Article 18Retention
Destroy personal data without undue delay once it is no longer needed for its purpose.
Retention schedules with automated deletion jobs.
Implementing RegulationData subject requests
Answer within 30 days, extendable by another 30 with advance notice and a reason.
A request portal with an automatic deadline timer on every request.
Article 20 and RegulationBreach notification
Notify SDAIA within 72 hours of becoming aware, and tell affected people without undue delay.
A 72-hour breach runbook, rehearsed before you need it.
Two clocks you must beat.
When a breach happens or a request arrives, the clock starts the moment you know. Your systems should know first.
The ceiling on penalties.
Most violations start with a warning or a fine. The ceiling is high, and intentional disclosure of sensitive data is treated more harshly.
Qiwa, Mudad, GOSI
HR records that match, every month.
One employee, three platforms, three places to read the same numbers. When they disagree, your Nitaqat band drops or your wage file gets flagged before you notice.
One record. Three platforms. The same numbers.
Reconciliation runs before payroll closes, every month. Every gap shows up on your side first, with the fix to file through the official channel.
- Basic salary
- 9,000.00
- Housing
- 2,250.00
- Contributory wage
- 11,250.00
- Contract
- Fixed term · 2 years
Documented contract · basic 9,000.00
October WPS file · 9,000.00 + 2,250.00
Registered wage · 10,500.00
The monthly close. Before the platforms ask.
Smart ERPHR › October close- ✓Qiwa contracts match payroll142 / 142
- ✓WPS file ready for Mudad
- !GOSI wage differs from payroll1
- !Iqamas expiring within 30 days (Muqeem)2
What we deliver.
- ✓A reconciliation dashboardAcross HR, payroll, Qiwa, GOSI, Mudad and Muqeem.
- ✓A Qiwa contract trackerWith your Nitaqat exposure for each contract.
- ✓WPS payroll filesIn the format Mudad accepts, checked before upload.
- ✓GOSI alignment and Muqeem alertsWages aligned, and no iqama expires by surprise.
- ✓A monthly close checklistOfficial channels and exports only.
Saudi cloud hosting
Your data, at home in the Kingdom.
Most companies cannot say where their data sleeps: a backup in Europe, staff files in a personal cloud drive. The PDPL allows personal data to leave the Kingdom only under set conditions.
A map of where your data lives. What moves, what stays.
We start with an assessment: every system, every backup, every outside tool. Then we move what should move, and document what stays under the safeguards SDAIA sets.
REGION CODE ROLE Riyadh me-riyadh-1 primary Jeddah me-jeddah-1 backup ────────────────────────────────── restore test passed abroad 3 found › 0 open
- Database backupsMoved to Jeddah
- Employee filesMoved to Riyadh
- Database backupsFound abroadStorage bucket in Frankfurt
- Employee filesFound abroadA personal cloud drive
- Email marketing toolFound abroadAn overseas cloud service
Fast. And right the first time.
What we deliver.
- ✓A residency assessmentWhat lives where, and what must move.
- ✓A rehearsed migrationWith a rollback plan.
- ✓Backups in a second Saudi cityWith a tested restore.
- ✓A separate test environmentThat mirrors production.
- ✓Monitoring and a monthly reportWith alerts on every fault.
RHQ launch kit
Riyadh HQ, ready on day one.
The clock starts on licence day. Mandatory activities must begin within 6 months, and you need a website, an Arabic identity, email, invoicing and HR platforms before then.
The first 12 months. On MISA's clock.
The launch checklist. Tick what is ready.
Tick what is already done. What is left is your launch plan, and one team can build all of it at once.
Questions before the next deadline.
How do I know my ZATCA wave?
ZATCA notifies each targeted taxpayer at least six months before its integration date, based on VAT-subject revenue. Wave 25 covers revenue above SAR 187,500 in any year from 2022 to 2025. The free study confirms your wave and how ready your system is.
Do we have to replace our accounting system?
No. We connect e-invoicing to the ERP you run, whether Oracle, APEX or a custom system, or deliver a standalone app if yours cannot be connected.
Is hosting inside the Kingdom required by law?
Not for every company. The PDPL allows personal data to go abroad under conditions and safeguards set by SDAIA. Many companies choose Saudi hosting because it keeps compliance simple. The assessment shows what actually applies to you.
Do you replace our lawyer?
No. We build the tools: consent logs, deletion jobs, the request portal and the breach runbook. Notices and policies are written with your legal counsel.
Do you connect straight into Qiwa, Mudad and GOSI?
We use official channels and exports only: WPS files in the format Mudad accepts, reconciliation reports from your own data, and alerts before the close. Nothing unofficial.
Your next deadline is already dated.
The free study includes a ZATCA and PDPL compliance check. Get it first. Decide later.