Saudi VAT Confidentiality and Permitted Disclosures

VAT Confidentiality Is a Statutory Duty

VAT Law Article 35 requires ZATCA’s employees and those working for it or on its behalf to protect tax information received through their work. Implementing Regulations Article 55 sets out the permitted disclosure routes and the conditions for official disclosures. Read the two instruments together: Article 35 of the Law is not Article 35 of the Regulations.

The protection concerns tax information obtained in the relevant official capacity. It is substantial, but it is not an absolute rule preventing every exchange between public bodies, a court-ordered disclosure or a disclosure authorised in writing by the taxpayer.

For a business, the useful questions are what information is involved, who proposes to receive it, which legal route applies and what limits govern its use. A general statement that information is “confidential” does not answer those questions by itself.

Identify Which Disclosure Route Applies

Article 55(1) prohibits disclosure by Authority employees except through the cases in paragraphs 2, 3 or 4. Those cases serve different purposes:

Consent is therefore one route, not a prerequisite for every lawful disclosure. Equally, an ordinary commercial relationship does not automatically supply written consent. A parent company, lender, buyer or adviser should identify the legal basis for access instead of assuming that its role entitles it to ZATCA’s records.

Dariba recommendation: identify the precise route before discussing consent wording or transmission arrangements. This avoids trying to solve a statutory information-sharing case with a consent form, or treating a private request as if it were an official instruction.

Apply All Six Conditions to the Official-Duties Route

Article 55(3) permits necessary disclosure for the Authority’s duties and powers, subject to six requirements. They should be assessed together.

First, the disclosure must be in an official capacity to a listed recipient: an Authority employee, Customs, the public audit body named in the provision, a judicial body, or a foreign tax authority under a treaty or agreement to which the Kingdom is a party. The treaty condition matters; this is not general permission to send information to any overseas recipient.

Second, the employee must act under Authority instructions authorising the relevant function. Third, the disclosure must stay within its intended purpose, taking account of its possible personal or commercial effects. A legitimate recipient does not remove the need to control the scope of the material shared.

Fourth, the information must not be retained beyond the purpose of disclosure. Fifth, disclosed confidential information must be protected and handled with the precautions determined by the Authority against improper circulation, loss or damage. Sixth, before disclosure, the recipient must be made fully aware of its confidential nature and the Law’s confidentiality requirements.

These are legal requirements of the stated route. They should not be reduced to a requirement to mark an email “confidential” or to use one particular technology. A secure transmission method is useful, but it does not establish the recipient’s legal entitlement or the necessity of every document included.

Recipients Have Their Own Duties

VAT Law Article 35(2) requires recipients under the permitted framework to use the information only for the purpose for which access was granted and to preserve its confidentiality. Paragraph 3 restricts further disclosure except in the regulatory cases and requires the relevant documents to be returned to the Authority.

An authorised first disclosure therefore does not make later circulation unrestricted. Keep the original purpose and any applicable conditions attached to the information throughout its handling.

Dariba illustration: documents supplied to a permitted recipient for a defined tax purpose should not be treated as material for an unrelated commercial pitch merely because the recipient lawfully obtained them. The second use needs its own legal basis; the first disclosure does not establish it. This is our illustration of the purpose limitation, not an official ZATCA case or a report of an actual incident.

Written Consent Needs an Identified Taxpayer and Scope

Article 55(4) allows ZATCA to disclose a taxpayer’s tax information to another person on the taxpayer’s written consent. It preserves the confidentiality principle and does not dispense with the Article’s other provisions.

Dariba recommends identifying the consenting taxpayer, authorised signatory, intended recipient, relevant information and intended purpose. Retain the consent and the request together. Where several group companies are involved, establish whose information is covered rather than assuming that one company’s consent automatically covers every affiliate.

These are practical controls. Article 55(4) does not prescribe one universal consent form, a standard period for every consent, or an automatic right for an adviser to inspect unrelated records. An engagement letter between commercial parties should not be assumed to resolve the Authority’s separate disclosure requirements.

Confidentiality Does Not Cancel Lawful Information Powers

VAT Law Article 51(2) requires government bodies and persons to provide information requested for tax purposes. Implementing Regulations Article 56 separately addresses the Authority’s information powers.

Article 56(1) requires persons to supply information requested to establish their own tax obligations. Paragraphs 2–3 address direct and continuous access to directly relevant tax information held by the specified third parties: government bodies/entities, banks and other Saudi financial institutions supervised by the named monetary or capital-markets authorities. That defined category should not be expanded into a claim that paragraph 2 gives identical continuous-access powers over every private business database.

Paragraph 4 addresses a specified third party’s failure to provide required information. The confidentiality framework and the information duty must therefore be read together. A contractual confidentiality clause does not, by itself, answer whether a valid statutory request must be fulfilled.

For the separate examination and record rules, see VAT audits and the VAT record framework. Producing required evidence does not waive the Authority’s confidentiality duties; invoking confidentiality does not automatically suspend an unrelated filing or payment deadline.

Keep a Focused Record of a Disclosure Concern

If a disclosure appears too broad or its basis is unclear, preserve the communication, recipient details, stated purpose, information involved and any consent or instruction. Identify whether the issue concerns the initial disclosure, the amount of information supplied, retention, onward use or an information demand.

Dariba recommends seeking clarification through the appropriate official channel and recording the response. Avoid recirculating the confidential material unnecessarily merely to demonstrate the concern. Where a remedy is sought, identify the applicable procedure and supporting evidence separately: Articles 35 and 55 do not themselves state a universal compensation amount or automatic cancellation of a VAT assessment.

The CIT and Zakat disclosure provisions have their own wording. A company subject to more than one regime should apply the actual provision involved rather than copy a recipient list or control from another tax without checking its basis.