diff --git a/app/controllers/api/databases.php b/app/controllers/api/databases.php
index 7643172147..6ec28cfd8f 100644
--- a/app/controllers/api/databases.php
+++ b/app/controllers/api/databases.php
@@ -2253,10 +2253,6 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents/:docum
             Database::PERMISSION_DELETE,
         ]);
 
-        if (\is_null($permissions)) {
-            $permissions = $document->getPermissions() ?? [];
-        }
-
         // Users can only manage their own roles, API keys and Admin users can manage any
         $roles = Authorization::getRoles();
         if (!Auth::isAppUser($roles) && !Auth::isPrivilegedUser($roles) && !\is_null($permissions)) {
@@ -2278,6 +2274,10 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents/:docum
             }
         }
 
+        if (\is_null($permissions)) {
+            $permissions = $document->getPermissions() ?? [];
+        }
+
         $data = \array_merge($document->getArrayCopy(), $data);
         $data['$collection'] = $collection->getId();            // Make sure user doesn't switch collectionID
         $data['$createdAt'] = $document->getCreatedAt();        // Make sure user doesn't switch createdAt