Company Records and Confidentiality: Distinguishing Protection from Obstruction

The practical question and its limits

A records request is refused on confidentiality grounds. Protection or obstruction?

Start by identifying what happened and who is authorized to act, separating verifiable records from unproven conclusions. Access requests, audit or inspection work, and disclosure incidents; not every requester has authority to obtain every record.

Legal framework and verification limits

Companies Law Article 261(j) addresses intentional obstruction of persons legally entitled to access records or refusal to enable their work. Article 261(i) addresses exploitation or disclosure of company secrets with intent to harm by the persons listed there; Article 261(d) separately concerns public servants. Article 20(4) addresses the auditor’s access and difficulties encountered. The requester’s capacity and entitlement, the information’s confidentiality and the purpose of withholding or disclosing it must be assessed separately.

https://www.uqn.gov.sa/details?p=19697 https://misa.gov.sa/app/uploads/2025/07/Companies-Law.pdf

What could change the interpretation?

Delay may arise from an unclear request, verification of authority or a legitimate restriction on third-party data; disclosure may be authorized or legally required. A record missing from one person’s file may exist elsewhere. Ask authorized custodians about its source, version and date, and record both supporting and contrary evidence.

Records and questions

• Access request, requester’s capacity and scope
• Responses and reasons for refusal or delay
• Authorization policies and lawfully available access logs
• Information classification, recipients and basis for disclosure
• What creates the requester’s access right and what is its scope?
• Was there intentional refusal or a documented administrative difficulty?
• Was the information confidential, who received it and what authorized disclosure?

Hypothetical example

Hypothetical example: an appointed auditor requests identified entries and is told the system is unavailable. Outage logs, alternative access arrangements and communications help test the explanation; delay alone does not establish intentional obstruction.

Initial response and readiness

If authorized, identify custodians and the relevant preservation scope while retaining originals and context. Do not alter source files or access personal accounts or devices without authority. If harm continues or proceedings are known, obtain advice on context-specific action. These steps do not automatically call for confrontation, dismissal or reporting. Use a documented access-request process that checks authority and scope and records the response, alongside defined permissions for preservation and sharing.

Professional review

Technical questions may require an accountant or another specialist. Their findings on value, images or data flows do not replace analysis of legal responsibility. Identify the prospective client before seeking the case file: company representation and defence of an individual are separate routes, and joint representation is not assumed.

Request a consultation

A paid legal consultation begins with identifying the parties, a conflict check and agreement on scope and fees. It includes an initial review of documents within an agreed scope, a meeting to discuss facts and questions, and a brief written summary of options, missing information and the next step in the agreed language. An internal investigation, settlement, report or representation requires a separate engagement as appropriate.