⁦Oman PDPL⁩

⁦Oman⁩ الخصوصية

الحالة

⁦Published 13 February 2022 (Official Gazette No. 1429). Executive Regulation: Ministerial Decision No. 34/2024 (Official Gazette No. 1531), which gave entities one year to comply. Royal Decree No. 68/2026 of 3 September 2026 amended the law from the day after its publication (Official Gazette No. 1664).⁩المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

على من ينطبق

⁦Since Royal Decree No. 68/2026: processing of personal data of natural persons in Oman, whether the processing takes place in Oman or abroad (Art. 2). Excluded (Art. 3): national security or public interest; state bodies exercising their legal powers; the state⁩'⁦s economic and financial interests; detecting or preventing a crime on a written request from investigators; personal or family processing that is not published; and authorised research that identifies no one.⁩✓⁦Arts. 2–3 (Royal Decree No. 68/2026) ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

حدود الحجم

⁦No size or turnover threshold. Since Royal Decree No. 68/2026 a controller is a legal person that processes data itself or through a processor (Art. 1).⁩المصادر: ⁦mtcit.gov.om⁩

الجهة الرقابية

⁦The Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department, without prejudice to the powers of the Cyber Defence Centre (Art. 7).⁩✓المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Tell the Ministry⁩'⁦s competent department within 72 hours of becoming aware of a breach that poses a risk to data subjects⁩' ⁦rights, and tell the data subjects within 72 hours if it may cause them serious harm or high risk (law Art. 19; Executive Regulation Arts. 30 and 32).⁩✓⁦Executive Regulation Arts. 30, 32 ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

مهلة الرد على طلبات البيانات الشخصية

⁦Respond within 45 days, free of charge (Executive Regulation Art. 16), to requests to withdraw consent, correct, update or block data, get a copy, move it to another controller or erase it (law Art. 11).⁩✓⁦Executive Regulation Art. 16 ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

مسؤول حماية البيانات

⁦Mandatory: every controller designates a personal data protection officer and publishes the officer⁩'⁦s name and contact details (law Art. 20; Executive Regulation Arts. 34 and 35).⁩✓⁦Art. 20; Executive Regulation Arts. 34–35 ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

الممثل المحلي

⁦Neither the law nor the Executive Regulation requires a representative in Oman.⁩

نقل البيانات إلى الخارج

⁦Allowed under the Executive Regulation⁩'⁦s controls (law Art. 23): the data subject⁩'⁦s explicit consent, unless an international obligation or anonymised data applies (Executive Regulation Art. 37); an adequate level of protection at the recipient (Art. 38); and a documented transfer risk assessment (Art. 39). Transferring data processed in breach of the law, or that would harm the data subject, is banned (law Art. 23).⁩✓⁦Art. 23; Executive Regulation Arts. 37–39 ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

ملفات تعريف الارتباط والموافقة

⁦Explicit consent before processing or changing its purpose, requested in writing and naming the controller, the data protection officer and the purposes (Art. 10, as replaced in 2026); exceptions include a legal obligation, public data, vital interests and a contract with the data subject (Art. 10 bis). Sensitive data needs a Ministry permit (Art. 5), except employee data and security cameras (Art. 5 bis). Marketing needs explicit consent (Art. 22). People may object to automated decisions (Art. 14).⁩✓⁦Arts. 5 bis, 10, 10 bis (2026) ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

أقصى عقوبة

⁦Fines of OMR 100,000 to 500,000 for unlawful transfers abroad (Art. 29); OMR 15,000 to 20,000 for breaking the sensitive-data, children⁩'⁦s data, breach notice or confidentiality rules (Art. 28); a legal person OMR 5,000 to 100,000 (Art. 30). The Ministry may also impose administrative fines up to OMR 2,000 (law Art. 32; Executive Regulation Art. 44).⁩✓⁦Arts. 28–30, 32 ↗⁩ · المصادر: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Get explicit written consent, or rely on a listed exception, before processing (Arts. 10 and 10 bis).⁩
• ⁦Get an MTCIT permit before processing sensitive data, such as genetic, biometric, health or criminal data (Art. 5; Executive Regulation Arts. 5 to 8).⁩
• ⁦Designate a personal data protection officer and publish the contact details (Art. 20; Executive Regulation Arts. 34 and 35).⁩
• ⁦Report a risky breach to MTCIT within 72 hours and tell affected people within 72 hours where the harm is serious (Executive Regulation Arts. 30 and 32).⁩
• ⁦Answer data subject requests within 45 days, and run a risk assessment before transfers abroad (Executive Regulation Arts. 16 and 37 to 39).⁩

التغييرات الأخيرة

⁦Royal Decree No. 68/2026 (3 September 2026, Official Gazette No. 1664) extended the law to data of people in Oman processed abroad, limited⁩ '⁦controller⁩' ⁦to legal persons, rewrote the exemptions and the consent rule, added exceptions to the sensitive-data permit and to consent (Arts. 5 bis and 10 bis), and added a right to object to automated decisions (Art. 14).⁩✓

المصادر

• المصدر الأساسي: ⁦https://www.mtcit.gov.om/library-3/legislations-policies-8/laws-75/personal-data-protection-law-1034⁩
• المصدر الثاني: ⁦https://www.mtcit.gov.om/library-3/legislations-policies-8/regulations-72/executive-regulations-of-the-personal-data-protection-law-1035⁩
• الجهة الرقابية: ⁦The Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department, without prejudice to the powers of the Cyber Defence Centre (Art. 7).⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.