Needs legal review before use
This matrix collects reported rules to help you ask the right questions. It is not legal advice, it does not say that any fleet, platform or Tracom product meets a law, and rules change. Verify against the current official text with a local adviser.
Why does the server location matter?
A tracker sends positions, events and sometimes video to a platform. That platform runs on servers in a country, with backups and support teams that may sit in others. Some countries ask for tracking data to stay inside their borders. Others allow transfers with a permit or safeguards. A fleet that runs in several countries can meet more than one rule at once.
Rules recorded on this page
| Country | Rule as reported | Authority | Confidence |
|---|---|---|---|
| Iraq | Tracking databases and servers inside Iraq only, no transfer abroad. The regulator is given an IP address to verify. Records kept at least 4 years from the contract date. Read from the official file uploaded in March 2025. A newer version dated 25 May 2026 is listed on the CMC site but could not be opened. | Communications and Media Commission (CMC), GPS service controls, chapter 7 | Official text read |
| Egypt | Executive Regulations of the Personal Data Protection Law 151 of 2020 (Ministerial Decision 816 of 2025, Official Gazette issue 244 bis, 1 November 2025): a licence or permit from the PDPC is needed to transfer personal data outside Egypt (Articles 16 and 23 to 25). The Center decides a transfer application within 90 working days, and no answer counts as a refusal (Article 26). Read in a law-library copy of the decree, not in the Gazette. | Personal Data Protection Center (PDPC), decree text in a law-library copy | Reported, verify |
| Nigeria | General Application and Implementation Directive (NDPC/NDP ACT-GAID/01/2025), dated 20 March 2025, announced in force on 19 September 2025: Article 45 makes Part VIII of the Nigeria Data Protection Act 2023 the governing rule for transfers abroad, and Article 48(2) refers to Commission approval of transfer instruments. The text read has no data-localization clause. | Nigeria Data Protection Commission (NDPC), official directive text | Official text read |
| Saudi Arabia | Regulation on Personal Data Transfer outside the Kingdom, read on the SDAIA site: a list of countries with adequate protection (Article 3), safeguards by standard contractual clauses, binding common rules or an accreditation certificate (Article 4), and a risk assessment before transfers on safeguards, transfers of sensitive data and continuous or large-scale transfers (Article 7). The regulation has no data-localization clause. The 2024 IoT Regulations of the communications regulator contain no data-localization clause either. Full enforcement of the law since 14 September 2024 is reported by CMS. | Saudi Data and AI Authority (SDAIA), official regulation text | Official text read |
| Oman | Telecom regulator Decision 89 of 2022 issuing the regulation on tracking and geolocation services (Official Gazette issue 1443, 29 May 2022): Article 10 keeps SMS centres, support centres and the service equipment, including subscriber data storage, inside Oman, and bars moving service or subscriber data outside Oman. Read in a legal-database copy of the Gazette text. Check the current text on the regulator site. | Telecommunications Regulatory Authority (TRA), Gazette text in a legal-database copy | Reported, verify |
| United Arab Emirates | Federal Decree-Law 45 of 2021 on personal data: executive regulations reported as not yet published in January 2025, and still reported as not issued in August 2026. No hosting rule is recorded on this page. | UAE Data Office, reported by DLA Piper | Reported, verify |
How a country is marked
| Rule recorded | Hosted in the country | Hosted elsewhere |
|---|---|---|
| Data must stay in the country | No conflict recorded if backups stay too, otherwise conflict | Conflict |
| Transfer needs a permit or safeguards | No conflict recorded, check backups | Verify or act: permit or safeguards |
| Not researched | Verify | Verify |
"No conflict recorded" means only that this page found nothing against your answers. It is never a pass.
What to ask the platform host
- Where are the main servers, the backups and the disaster-recovery copies, by country?
- Who can open our data remotely, and from which countries?
- Can you host inside a given country and show the server address a regulator can check?
- Which permit, contract clauses or approval cover data that leaves a country?
- How do we export and delete our data when the contract ends?
What the device decides, and what it does not
A tracker sends its data to the server address it is set to. It does not decide where the platform stores it, how long backups are kept or who can open them. Those are platform and hosting choices. When you change hosts, the devices are pointed at the new address, which is a configuration task you can plan with the device maker.
Sources and limits
- Iraq: CMC controls for the GPS service, official file uploaded March 2025. A newer version dated 25 May 2026 is listed on the CMC site but could not be opened.
- Egypt: Decree 816 of 2025 in a law-library copy. The Official Gazette copy could not be reached.
- Nigeria: official NDPC directive text.
- Saudi Arabia: official SDAIA transfer regulation. The IoT Regulations were read on the regulator site.
- UAE: DLA Piper country page. Oman: TRA Decision 89 of 2022 in a legal-database copy.
- All sources were last checked on 2026-11-03. Rules marked "reported" come from law firms or news. Verify against the current official text.
- The matrix runs in your browser. If you ask for the emailed report, your answers are sent to our server with the request and kept for up to 45 days.