Iqama Management

Visa Management Software Checklist for Saudi HR and PRO Teams

Last updated 2 October 2026

A visa management software checklist should test six areas. These are the record and its alerts, the control of cases, approvals and documents, cost reporting per employee, what the system really does with Qiwa, Muqeem and Absher Business, where personal data sits and who can see it, and how your data gets in and out. Put the same written questions to every vendor and ask each to answer with your own sample records.

Disclosure: WASNA Digital Solutions implements Infinigent DIM, a digital Iqama management product. This checklist does not rank vendors of visa management software, and every question applies to any product, including the one we implement.

What a visa management software checklist should cover

Visa management software is a central system for the employer-side work behind expatriate employment. It handles requests, documents, approvals, expiry dates and costs for each visa, iqama and work permit case, and it runs beside the government platforms without replacing them. Our guide to Qiwa, Muqeem and Absher sets out what each platform does, and the page on digital visa management describes the category.

Where an HR system is built around the employee, visa management software is built around the case and its next expiry date. The two usually exchange employee data, which is why integration appears further down.

A spreadsheet is enough while one person handles every case. A visa management software checklist starts to matter when cases span several entities, branches or people.

Iqama tracking software and the record it must hold

A renewal fails on its conditions, not on the iqama date. The Absher Business guide lists payment for the renewal period, a valid passport, a valid work permit, medical insurance in place, fingerprints and photos on file, no unpaid traffic violations, and the worker not being registered as absent (Absher Business guide, October 2021). The Council of Health Insurance adds that employers must arrange cooperative health insurance for employees and their family members in the private sector (CHI). Check that the visa management software tracks all of it.

One record per employee links the iqama, passport, work permit, insurance policy and employing entity. Ask for a demo with a passport that expires before the iqama, and see which alert fires.
Each document has its own expiry date and its own lead time, set by document type and by entity.
Visa cases carry their own deadlines. The guide requires a passport valid for 90 days or more for exit and re-entry and final exit visas, and a final exit visa has to be used within two months of issue. A system that tracks only document dates misses both.
Every alert goes to a named person, escalates if nothing changes, and has a delegate for leave.
Hijri and Gregorian dates both display and convert on entry. Government announcements, such as HRSD’s, show both side by side.
Arabic and English names are stored, and you can search by iqama number, passport number or name, with a warning on duplicates.
Dependants are either in scope, with their own linked records, or clearly out of scope.

Cases, approvals and work permit management

Ask which case types the visa management software runs as workflows, with steps and statuses, and which it only holds as notes. The baseline is what the government platforms themselves handle, such as iqama issuance and renewal, work permit issuance and renewal, exit and re-entry and final exit visas, transfers of services and occupation changes.

Each case type has defined steps, required documents and a status anyone can read.
Work permit management is a case type in its own right and links to the iqama case, because HRSD describes the work permit as one of the conditions for issuing or renewing the iqama (HRSD).
Approvals can be set by entity, case type and cost, and the cost is visible before anyone approves.

Expat document management and the audit trail

Documents sit against both the employee and the case, with upload dates and versions.
The audit trail shows who created or changed a date, an amount or a status, and when. No date can be edited without a log entry.
If a vendor says the system reads passport or iqama scans, run your own scans, including poor ones, and count the fields that need correcting.
Access follows roles and can be limited by entity. A leaver loses access the same day.

Costs per employee

HRSD explains that Article 40 of the Labour Law puts on the employer the fees for issuing and renewing the iqama and work permit, fines resulting from delay, and the fees for changes of profession, exit and re-entry visas, return tickets and service transfers (HRSD). A cost record in visa management software needs a line for each kind.

Costs are typed as government fee, fine, service charge or ticket, with the receipt attached.
Reports run by employee, department, entity, case type and period, and export to the finance system.

Ask for last year’s total visa spend for one named employee.

Visa tracking system integrations and what connected means

“Integrated with government platforms” can mean anything from copying data by hand to an authorised connection, so ask each visa management software vendor to name the mechanism for every transaction. The usual possibilities are manual entry with reminders, file import and export, data capture from scans, scripted entry into a platform’s screens, and a connection through a channel the platform owner provides. For each one, ask:

Which platform and which transaction it covers, shown live while you hold the login.
Who authorises it on the platform side, and what happens when the platform changes a screen or a rule.
Where the log of what was submitted is kept.

Be wary of any design that relies on staff sharing one login. Absher Business offers authorisation, which lets the owner authorise another registered Absher user to carry out a specific service through that user’s own account (Absher Business guide, October 2021). Ask how the product’s access model works with it. Employee data usually arrives from the HR system, so also ask which system holds the master record and how leavers are handled.

Data protection and hosting under the PDPL

Visa management software holds personal data about expatriate staff and often their families. The Personal Data Protection Law (PDPL) names identity numbers and images in its definition of personal data and lists health data as sensitive, so passport copies, iqama records and insurance or medical details fall within it (SDAIA, PDPL Article 1). The law entered into force on 14 September 2023, with entities given up to a year to adjust (SPA). This is general information, not legal advice. Take your own position to a qualified adviser.

Roles and contract. You are the controller and the vendor processes data for you. Article 8 says a controller may only select processors that provide the necessary guarantees and must monitor their compliance, without reducing its own responsibilities. Ask for the processing terms, the sub-processor list and your audit rights.
Security. Article 19 requires adequate organisational, administrative and technical measures. Ask for the vendor’s security documentation covering encryption, access control, logging and testing.
Breaches. Article 20 requires the controller to notify the competent authority on learning of a leak, damage or unauthorised access. The contract should oblige the vendor to tell you fast enough for you to do that.
Location and access. Article 29 sets conditions for transferring personal data outside the Kingdom or disclosing it to a party outside it. Ask where data and backups are held, and whether any vendor staff or sub-processor abroad can see them, including through support. The reasoning is in our data residency explainer.
Retention. Ask how long data is kept after the contract ends and how deletion is confirmed.

Migration, support and exit

Reconcile your records against each platform before loading anything. Absher Business can produce a Muqeem print report of a worker’s basic data. The guide says it is not official proof of status, but it works as a data extract for checking.
Expect the clean-up of old dates and missing documents to take longer than the load, and ask who does it.
Run old and new records side by side for one full alert cycle.
Ask for an implementation plan with named roles, training for PRO staff, approvers and finance, and support hours that match your working week and language.
Compare the cost of each visa management software option over three to five years, including implementation, migration, integrations, support and the price of extra entities and users as headcount grows.
Confirm you can export all data and documents in a usable format, and that deletion on request is confirmed in writing.

Scoring the visa management software checklist

Run five scenarios with every vendor. Renew an iqama for an employee whose passport expires in 60 days. Process a transfer of an employee into your entity, with approval and cost. Show who changed an expiry date last month. Report visa spend for the year by entity. Remove a leaver’s access and show what that person could see before.

Then score each item on the visa management software checklist from 0 to 3.

Score	Meaning
0	Not offered
1	Possible only through a manual workaround
2	Works after configuration
3	Shown live with your sample data

Weight the groups to suit your operation. Treat an unclear data location, a missing audit trail or an integration that depends on shared passwords as deal-breakers until the vendor resolves them.