Sign in

PDPL

Saudi Arabia’s PDPL,
answered by architecture

The Personal Data Protection Law asks where personal data lives, why it is collected, who can reach it and how you answer the people it describes. Countly answers with the deployment itself: run it on infrastructure in the Kingdom, collect only what you decide, and handle consent and data requests on the server that holds the data.

In this demo bank, a week of consent as the apps reported it: 1,142 opt-ins and 144 opt-outs, day by day, on the bank’s own server.

What the law asks

Six obligations,
and where Countly meets them

PDPL is enforced by SDAIA, the Saudi Data and AI Authority. These are the parts of it that product analytics touches, and the part of Countly that handles each.

Data localization

Keep personal data in the Kingdom

PDPL limits transfers of personal data outside Saudi Arabia. Countly Enterprise runs on infrastructure you choose, your data center or a cloud region in the Kingdom, so analytics data never has to leave the country to be measured.

  • Self-hosted on your infrastructure
  • Air-gapped networks supported
  • No default vendor access
  • Reports computed where the data is

Data subject rights

Answer access and erasure requests

A person can ask for a copy of their data, or for it to be destroyed. Compliance Hub exports one profile’s data in a single file or purges it, and records who ran each request and when.

  • Export profile data
  • Purge profile data
  • Export and purge history
  • Recorded in the audit log

Consent

Track only what people allowed

Your app asks for consent, and the SDK reports each answer feature by feature. Turn on Require consent and every SDK of the project waits for a decision before it tracks anything.

  • Consent per feature
  • Require consent
  • Consent history per profile
  • Opt-in and opt-out counts

Accountability

Give your DPO the controls

Whoever answers for personal data can see what each app collects, keep out what should not arrive, and show every change made to the setup, with who made it.

  • One schema per project
  • Personal data flagged on arrival
  • Audit log of every change
  • Exports as evidence

Data minimization

Collect only what the purpose needs

Decide which events, properties and features are collected, and change it from the server without an app release. Personal properties can be masked, hashed or dropped before they are stored.

  • Event approval
  • Block events and properties
  • Turn off location tracking
  • Masking at ingestion

Security

Protect it, and limit who sees it

Data is encrypted in transit and at rest. People sign in through your identity provider, and access is granted project by project and feature by feature.

  • TLS in transit
  • Encryption at rest
  • Single sign-on and two-factor
  • Per-feature permissions

The features

The parts of Countly
that do the work

Each one handles part of PDPL, on the same data and the same server as your analytics.

Read the PDPL guide
Compliance Hub

Consent per feature, with its history, and data export and purge requests with the record of each.

Open Data Manager

The schema every app is held to, with personal data flagged when it arrives where it shouldn’t.

Open SDK Manager

Turn tracking features off, require consent and block events from the server, for every SDK at once.

Open Audit Logs

Every change and every profile export or deletion, with the account, the time and the values before and after.

Open

Data ownership

Where the data lives
is your decision

Under PDPL, the deployment answers the first question an auditor asks. Both editions are single-tenant, and Enterprise can run entirely inside the Kingdom.

Data privacy
AspectFlexEnterprise
EnvironmentDedicated single-tenant instanceYour cloud, your data center or air-gapped
Data residencyThe Google Cloud region you chooseWherever you deploy, including air-gapped networks
Vendor accessOperated by Countly; access limited, granted by you and loggedNo default access
ISO 27001Certified
ISO 27017Certified
ISO 27018Certified
SOC 2Type II examined
TISAX®Participant*

*Countly Ltd. is a TISAX® Participant. TISAX® is a registered trademark of and governed by ENX Association. Learn more at enx.com/tisax

Does using Countly make us PDPL compliant?

No tool can do that on its own: compliance also depends on your purposes, notices, contracts and processes. Countly provides the technical parts: where the data is stored, what is collected, consent, data subject requests, access control and an audit trail. Your legal team decides how they fit your obligations.

Can Countly run entirely inside Saudi Arabia?

Yes, with Countly Enterprise. It runs on infrastructure you operate, in your own data center or a cloud region in the Kingdom, including air-gapped networks, and Countly has no access unless you grant it.

Does the AI agent send data outside our servers?

It does not have to. When self-hosted, Cee’s product agents can run inside your infrastructure, configured with a self-hosted inference endpoint or your own AI provider. The Documentation Agent, the Countly AI Gateway (EU) and third-party AI providers run outside your infrastructure.

Do you sign a data processing agreement?

Yes. Each edition has its own data processing agreement and subprocessor list, on the legal page.

Data residency

Your data.
Your country.
Your rules.

Talk to salesData privacy