HR data migration works when you decide what to move before mapping anything, fix errors in the source records rather than in the load, and prove every trial load against control totals that HR and finance both sign. In Saudi Arabia the checks also cover iqama, contract, social insurance and bank records, and the whole exercise counts as processing personal data under the PDPL.
Disclosure: WASNA Digital Solutions implements Infinigent HCM in Saudi Arabia. This HR data migration checklist applies to any HR system and any implementation partner, including us.
The legal references below are general information, not legal advice. Confirm them with a qualified adviser or the official authority before relying on them.
Decide what HR data migration should cover
HR data migration is not a copy of the old database. Before anyone writes a mapping, sort every record set into records that go live, records that are archived read-only and records that are left behind.
| Treatment | Typically includes |
|---|---|
| Load into the new system | Active employees’ master data, current contract and pay terms, leave balances and end of service opening balances at the cut-over date, open loans, year-to-date payroll, valid documents |
| Archive read-only | Leavers’ files and past payroll within your retention period, disciplinary and fines records, superseded contracts |
| Leave behind | Duplicates, test and dummy records, fields nobody uses, expired documents with no legal purpose, biometric templates the new system does not need |
The PDPL points the same way when you scope an HR data migration. Article 11(3) says the content of personal data must be appropriate and limited to the minimum necessary for the purpose of collection. Article 18 requires a controller to destroy personal data without delay once that purpose ends, unless a legal basis requires it to be kept for a set period. The Labour Law adds that an employer must keep records, statements and files at the workplace, with their nature and contents set by the Regulations (Article 17). Ask your adviser how long each record set must be kept before you mark anything as left behind.
HRIS data migration for employee master data, record by record
Employee master data is the core of any HCM system. Payroll, leave and end of service all inherit its defects, so errors here spread through the whole HR data migration. For each record set, check the new data against the source named in the table, not against the old system.
| Record set | Check against | Verify before loading |
|---|---|---|
| Identity | National ID, iqama or passport | One record per person, name spelled as on the identity document with the Arabic name where you hold it, and the same date of birth in every source |
| Residency and work permit | The iqama and the resident worker data on Muqeem | Iqama number, profession and expiry date agree, and expired documents load with an expired status instead of as valid |
| Employment contract | Signed contract and the contract on Qiwa | Start date, job title, duration and working hours agree. HRSD’s contract service asks for job title, contract duration, working hours and financial obligations. Hold Qiwa contract status as its own field |
| Pay structure | Contract and the last payroll run | Components held separately and totalling the last payroll to the riyal. HRSD’s guideline on enforceable contracts lists basic salary, housing allowance, transportation allowance and the total of other cash allowances |
| Bank details | Bank records | A Saudi IBAN has 24 characters, made up of SA, two check digits, a two-digit bank code and an 18-character account number (ECBS). Run a check-digit test and confirm the account holder’s name |
| Social insurance | GOSI registration | Registered wage agrees with payroll. HRSD says an uploaded wage protection file is processed and conformed to social insurance regulations, and GOSI’s employer FAQ says a request to rectify a contributory wage is considered only in the insurance year of the payment or in the first three months of the next |
| Leave and end of service | Leave records and the finance ledger | Opening balances at the cut-over date by leave type, and an end of service liability per employee that finance agrees |
| Loans, deductions and fines | Signed agreements and the fines record | Outstanding balance and instalment for each. Article 73 of the Labour Law requires a special record of fines, so bring that history across |
| Documents | The document store | Each file linked to the right employee, with medical reports and similar items flagged as sensitive |
Where a source shows a Hijri date, keep the original value beside the converted Gregorian date throughout the HR data migration, so a disputed date can be traced later.
Data cleansing means fixing defects at the source
In HR data migration, fix errors in the old system or the source file, not in the load script. A fix at the source survives a re-run, and the old system stays correct until cut-over. These are the common ones.
- Duplicates. The same person under two spellings or two employee numbers. Match on the identity number first and the name second.
- Orphans. Employees with no department, manager or cost centre, and managers who left but still sit in an approval chain.
- Conflicting dates. A contract that ends before it starts, a payroll line after the leaving date, or an iqama that expired before the joining date.
- Free text where the new system expects codes. Nationalities, job titles and departments typed in many ways need a mapping table that the business signs.
- Mixed units and formats. Monthly against annual pay, day-first against month-first dates, and Hijri against Gregorian.
- Stale status. Staff marked active long after leaving, or on leave for years.
Log every correction with the name of the person who approved it. HR can then answer an auditor about the HR data migration, and explain later why a value changed.
Prove every HR data migration load with control totals
Every HR data migration should run at least two trial loads before the final one. After each, compare the new system with the source using the controls below and record the result. A load passes when every difference is explained and signed by the data owner.
| Control | Compare | Passing result |
|---|---|---|
| Headcount | Active, on leave and leavers by establishment | Equal, or each difference listed with its cause |
| Basic wage and each allowance | Totals by component | Equal to the riyal |
| Bank details | Employees paid by bank transfer against valid IBANs loaded | Every exception fixed or accepted in writing |
| Leave balances | Totals by leave type | Equal |
| End of service opening liability | Each employee, against the finance ledger | Equal and signed by finance |
| Year-to-date payroll | Gross pay, deductions and net pay by month | Equal |
| Rejected records | The load’s rejects log | Each fixed at source or accepted in writing |
| Sample read | A random sample of employee files, read field by field | No unexplained difference |
The first payroll run in the new system is the final control of the HR data migration. The parallel run and go-live steps are in the HR software implementation checklist.
Does the PDPL apply to HR data migration?
Yes. SDAIA’s guide to the Personal Data Protection Law defines processing to include collecting, storing, transmitting, sharing and erasing personal data by any means, so an HR data migration is processing, and the employer that decides its purpose is the controller. The law took effect on 14 September 2023, with a one-year grace period from that date. For a migration, the articles translate into these tasks.
- Vendors and partners. Article 8 requires a controller to choose a processor that provides the necessary safeguards and to verify its compliance. Settle data protection terms in the HR data migration contract before any extract leaves your hands.
- Accuracy. Article 14 bars processing without sufficient steps to verify accuracy and completeness, which is what the cleansing step provides.
- Security. Article 19 requires organisational, administrative and technical measures. For a migration that means no employee data in emailed spreadsheets, named access to extracts, and deletion of each trial extract once its reconciliation is signed.
- Incidents. Article 20 requires a controller to notify the competent authority when it becomes aware of a leak or damage of personal data. Agree beforehand who reports a lost extract, and to whom.
- Location. Article 29 and SDAIA’s Regulation on Personal Data Transfer Outside the Kingdom cover transferring or disclosing personal data to a party outside the Kingdom, which may matter if an offshore team can reach the data or if hosting or support sits abroad. Data residency in Saudi Arabia explains the rules.
- Sensitive data. The PDPL’s definition of sensitive data includes health data and biometric identifiers. Medical reports and fingerprint templates deserve a separate decision on whether they move at all.
Cut-over and rollback in an HR system implementation
Freeze changes in the old system at an agreed time, load the final difference, reconcile it and keep the old system read-only afterwards. Agree the rollback rule in advance, covering which failed control stops go-live, who decides and what the fallback is. If payroll is part of the HR data migration, cut over just after a month-end so year-to-date totals have a clean starting point.
Get your HR data migration scope and controls reviewed
Tell us your source systems, headcount and number of entities, and we will go through what to load, what to archive and which control totals to set before your first trial load.
Sources
- Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H), Articles 1, 8, 11, 14, 18, 19, 20 and 29, Saudi Data and AI Authority (SDAIA), National Data Governance Platform. dgp.sdaia.gov.sa. Accessed 2 October 2026.
- Guide to the Saudi Personal Data Protection Law (for controllers and processors), SDAIA. dgp.sdaia.gov.sa. Accessed 2 October 2026.
- Regulation on Personal Data Transfer Outside the Kingdom, Version 2.0, August 2024, SDAIA. dgp.sdaia.gov.sa. Accessed 2 October 2026.
- Labor Law (Royal Decree No. M/51 of 23/8/1426H), English text, Articles 17 and 73, Ministry of Human Resources and Social Development. hrsd.gov.sa. Accessed 2 October 2026.
- Contract Management service, Ministry of Human Resources and Social Development. hrsd.gov.sa. Accessed 2 October 2026.
- Guideline for the initiative Documented Employment Contract as an Enforceable Instrument, Ministry of Human Resources and Social Development. hrsd.gov.sa. Accessed 2 October 2026.
- Uploading the Wage Protection file, Ministry of Human Resources and Social Development. hrsd.gov.sa. Accessed 2 October 2026.
- Employer FAQ, General Organization for Social Insurance (GOSI). gosi.gov.sa. Accessed 2 October 2026.
- Muqeem portal for resident worker data and transactions, Saudi government service. muqeem.sa. Accessed 2 October 2026.
- Saudi Arabia bank account number (IBAN) structure, European Committee for Banking Standards (ECBS). ecbs.org. Accessed 2 October 2026.
