1 Purpose and classification
This policy governs creation, registration, storage, access, retrieval and destruction of paper and electronic records. Each record is classified as administrative, financial, health, human-resources or compliance-related, identifying its owner, location, permissions, retention period and basis.(1)
2 Mandatory records
Records retained include members, approved Board and General Assembly minutes, reports, activities, overseas projects, Articles, resolutions, circulars, structure, contracts, agreements, permits, personnel files, incoming and outgoing correspondence and systems.
Financial books, invoices, assets, donor and donation registers, grants, receipts, disbursements, budgets, final accounts, audits and inventory minutes are retained. Publications and records include the Association’s name and proclamation and licence numbers and dates as required, drawn from verified documents without guessing.
3 Retention and starting dates
Administrative records are retained for at least five years and financial records for at least ten years. Destruction after those periods still requires competent-authority approval. Any longer period required by specific legislation, a dispute or regulatory request applies. Formation, ownership and material-decision documents are retained permanently as an internal control.
The schedule identifies the start of each period by its triggering event—year-end close, end of a relationship or contract, or last action—after checking applicable provisions. One start date is not applied to every record, and expiry of a general period does not permit deletion of health data subject to a special period.(2)
4 Storage and evidential validity
Clear names, codes, versions, movement logs and access permissions are used, with backups and restoration tests. Originals are preserved unchanged and scans linked to them, observing electronic-record and signature evidential requirements. An image is not an acceptable substitute for every legal original.
5 Holds and destruction
A dispute, investigation, complaint or official request triggers a preservation order identifying records, notifying technology personnel and owners, and stopping manual and automatic destruction. The hold is lifted only by a documented authorised decision after confirming its basis has ended.
The owner prepares a destruction list with retention basis, expiry and absence of holds. The Secretary, finance and privacy functions review it according to record type. Competent-authority approval is completed before secure, irreversible destruction, with a record of the list, method, executor and reviewer.
6 Access and handover
Access and export requests are recorded after verifying capacity, purpose and minimum necessary data. Member and regulator access rights are respected without unnecessary disclosure of others’ data. When employment, a system or a contract ends, records and indexes are handed over and readability tested before access is revoked or service stopped.
References in the approved document
-
Cabinet Resolution No. 5 of 2025, executive regulations for public-benefit institutions, Article 8 on record types, retention and destruction approval. This document establishes internal implementation controls without changing higher legal powers or requirements.
-
The Association’s approved 2026 Articles of Association, Articles 24 and 86; Federal Decree-Law No. 46 of 2021 on electronic transactions and trust services. This document establishes internal implementation controls without changing higher legal powers or requirements.