Oman PDPL

Oman Privacy

Status

Published 13 February 2022 (Official Gazette No. 1429). Executive Regulation: Ministerial Decision No. 34/2024 (Official Gazette No. 1531), which gave entities one year to comply. Royal Decree No. 68/2026 of 3 September 2026 amended the law from the day after its publication (Official Gazette No. 1664).Sources: mtcit.gov.om, mtcit.gov.om, mtcit.gov.om

Who it applies to

Since Royal Decree No. 68/2026: processing of personal data of natural persons in Oman, whether the processing takes place in Oman or abroad (Art. 2). Excluded (Art. 3): national security or public interest; state bodies exercising their legal powers; the state's economic and financial interests; detecting or preventing a crime on a written request from investigators; personal or family processing that is not published; and authorised research that identifies no one.✓Arts. 2–3 (Royal Decree No. 68/2026) ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Size thresholds

No size or turnover threshold. Since Royal Decree No. 68/2026 a controller is a legal person that processes data itself or through a processor (Art. 1).Sources: mtcit.gov.om

Regulator

The Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department, without prejudice to the powers of the Cyber Defence Centre (Art. 7).✓Sources: mtcit.gov.om, mtcit.gov.om

Breach or incident reporting

Tell the Ministry's competent department within 72 hours of becoming aware of a breach that poses a risk to data subjects' rights, and tell the data subjects within 72 hours if it may cause them serious harm or high risk (law Art. 19; Executive Regulation Arts. 30 and 32).✓Executive Regulation Arts. 30, 32 ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Deadline to answer personal data requests

Respond within 45 days, free of charge (Executive Regulation Art. 16), to requests to withdraw consent, correct, update or block data, get a copy, move it to another controller or erase it (law Art. 11).✓Executive Regulation Art. 16 ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Data protection officer

Mandatory: every controller designates a personal data protection officer and publishes the officer's name and contact details (law Art. 20; Executive Regulation Arts. 34 and 35).✓Art. 20; Executive Regulation Arts. 34–35 ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Local representative

Neither the law nor the Executive Regulation requires a representative in Oman.

Sending data abroad

Allowed under the Executive Regulation's controls (law Art. 23): the data subject's explicit consent, unless an international obligation or anonymised data applies (Executive Regulation Art. 37); an adequate level of protection at the recipient (Art. 38); and a documented transfer risk assessment (Art. 39). Transferring data processed in breach of the law, or that would harm the data subject, is banned (law Art. 23).✓Art. 23; Executive Regulation Arts. 37–39 ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Cookies and consent

Explicit consent before processing or changing its purpose, requested in writing and naming the controller, the data protection officer and the purposes (Art. 10, as replaced in 2026); exceptions include a legal obligation, public data, vital interests and a contract with the data subject (Art. 10 bis). Sensitive data needs a Ministry permit (Art. 5), except employee data and security cameras (Art. 5 bis). Marketing needs explicit consent (Art. 22). People may object to automated decisions (Art. 14).✓Arts. 5 bis, 10, 10 bis (2026) ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Maximum penalty

Fines of OMR 100,000 to 500,000 for unlawful transfers abroad (Art. 29); OMR 15,000 to 20,000 for breaking the sensitive-data, children's data, breach notice or confidentiality rules (Art. 28); a legal person OMR 5,000 to 100,000 (Art. 30). The Ministry may also impose administrative fines up to OMR 2,000 (law Art. 32; Executive Regulation Art. 44).✓Arts. 28–30, 32 ↗ · Sources: mtcit.gov.om, mtcit.gov.om

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Get explicit written consent, or rely on a listed exception, before processing (Arts. 10 and 10 bis).
• Get an MTCIT permit before processing sensitive data, such as genetic, biometric, health or criminal data (Art. 5; Executive Regulation Arts. 5 to 8).
• Designate a personal data protection officer and publish the contact details (Art. 20; Executive Regulation Arts. 34 and 35).
• Report a risky breach to MTCIT within 72 hours and tell affected people within 72 hours where the harm is serious (Executive Regulation Arts. 30 and 32).
• Answer data subject requests within 45 days, and run a risk assessment before transfers abroad (Executive Regulation Arts. 16 and 37 to 39).

Recent changes

Royal Decree No. 68/2026 (3 September 2026, Official Gazette No. 1664) extended the law to data of people in Oman processed abroad, limited 'controller' to legal persons, rewrote the exemptions and the consent rule, added exceptions to the sensitive-data permit and to consent (Arts. 5 bis and 10 bis), and added a right to object to automated decisions (Art. 14).✓

Sources

• Primary source: https://www.mtcit.gov.om/library-3/legislations-policies-8/laws-75/personal-data-protection-law-1034
• Second source: https://www.mtcit.gov.om/library-3/legislations-policies-8/regulations-72/executive-regulations-of-the-personal-data-protection-law-1035
• Regulator: The Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department, without prejudice to the powers of the Cyber Defence Centre (Art. 7).

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.