⁦OM⁩

⁦Oman PDPL⁩

⁦Personal Data Protection Law (Royal Decree No. 6/2022), amended by Royal Decree No. 68/2026⁩

ذرائع کے ساتھ ⁦· 10/14⁩ حقائق کی دو ذرائع سے تصدیق ہوئی. آخری تصدیق ⁦3⁩ نومبر، ⁦2026⁩

اگلی مکمل جانچ: مئی ⁦2027⁩. ریگولیٹرز کی خبریں ہر ماہ دیکھی جاتی ہیں؛ تبدیلیاں درج ہوتی ہیں: تبدیلیوں کا ریکارڈ.

اس صفحے کا حوالہ دیں: ⁦GlanceDesk Jurisdiction, “Oman PDPL (Oman)”, glancedeskjurisdiction.com/laws/om-pdpl, last verified 3 November 2026.⁩

⁦Oman⁩ پرائیویسی

حیثیت: ⁦Published 13 February 2022 (Official Gazette No. 1429). Executive Regulation: Ministerial Decision No. 34/2024 (Official Gazette No. 1531), which gave entities one year to comply. Royal Decree No. 68/2026 of 3 September 2026 amended the law from the day after its publication (Official Gazette No. 1664).⁩ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
یہ کن پر لاگو ہوتا ہے: ⁦Since Royal Decree No. 68/2026: processing of personal data of natural persons in Oman, whether the processing takes place in Oman or abroad (Art. 2). Excluded (Art. 3): national security or public interest; state bodies exercising their legal powers; the state⁩'⁦s economic and financial interests; detecting or preventing a crime on a written request from investigators; personal or family processing that is not published; and authorised research that identifies no one.⁩✓⁦Arts. 2–3 (Royal Decree No. 68/2026) ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
سائز کی حدیں: ⁦No size or turnover threshold. Since Royal Decree No. 68/2026 a controller is a legal person that processes data itself or through a processor (Art. 1).⁩ذرائع: ⁦mtcit.gov.om⁩
ریگولیٹر: ⁦The Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department, without prejudice to the powers of the Cyber Defence Centre (Art. 7).⁩✓ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
خلاف ورزی یا واقعے کی رپورٹنگ: ⁦Tell the Ministry⁩'⁦s competent department within 72 hours of becoming aware of a breach that poses a risk to data subjects⁩' ⁦rights, and tell the data subjects within 72 hours if it may cause them serious harm or high risk (law Art. 19; Executive Regulation Arts. 30 and 32).⁩✓⁦Executive Regulation Arts. 30, 32 ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ: ⁦Respond within 45 days, free of charge (Executive Regulation Art. 16), to requests to withdraw consent, correct, update or block data, get a copy, move it to another controller or erase it (law Art. 11).⁩✓⁦Executive Regulation Art. 16 ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
ڈیٹا پروٹیکشن آفیسر: ⁦Mandatory: every controller designates a personal data protection officer and publishes the officer⁩'⁦s name and contact details (law Art. 20; Executive Regulation Arts. 34 and 35).⁩✓⁦Art. 20; Executive Regulation Arts. 34–35 ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
مقامی نمائندہ: ⁦Neither the law nor the Executive Regulation requires a representative in Oman.⁩
ڈیٹا بیرونِ ملک بھیجنا: ⁦Allowed under the Executive Regulation⁩'⁦s controls (law Art. 23): the data subject⁩'⁦s explicit consent, unless an international obligation or anonymised data applies (Executive Regulation Art. 37); an adequate level of protection at the recipient (Art. 38); and a documented transfer risk assessment (Art. 39). Transferring data processed in breach of the law, or that would harm the data subject, is banned (law Art. 23).⁩✓⁦Art. 23; Executive Regulation Arts. 37–39 ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
کوکیز اور رضامندی: ⁦Explicit consent before processing or changing its purpose, requested in writing and naming the controller, the data protection officer and the purposes (Art. 10, as replaced in 2026); exceptions include a legal obligation, public data, vital interests and a contract with the data subject (Art. 10 bis). Sensitive data needs a Ministry permit (Art. 5), except employee data and security cameras (Art. 5 bis). Marketing needs explicit consent (Art. 22). People may object to automated decisions (Art. 14).⁩✓⁦Arts. 5 bis, 10, 10 bis (2026) ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩
زیادہ سے زیادہ سزا: ⁦Fines of OMR 100,000 to 500,000 for unlawful transfers abroad (Art. 29); OMR 15,000 to 20,000 for breaking the sensitive-data, children⁩'⁦s data, breach notice or confidentiality rules (Art. 28); a legal person OMR 5,000 to 100,000 (Art. 30). The Ministry may also impose administrative fines up to OMR 2,000 (law Art. 32; Executive Regulation Art. 44).⁩✓⁦Arts. 28–30, 32 ↗⁩ · ذرائع: ⁦mtcit.gov.om⁩, ⁦mtcit.gov.om⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

⁦Get explicit written consent, or rely on a listed exception, before processing (Arts. 10 and 10 bis).⁩
⁦Get an MTCIT permit before processing sensitive data, such as genetic, biometric, health or criminal data (Art. 5; Executive Regulation Arts. 5 to 8).⁩
⁦Designate a personal data protection officer and publish the contact details (Art. 20; Executive Regulation Arts. 34 and 35).⁩
⁦Report a risky breach to MTCIT within 72 hours and tell affected people within 72 hours where the harm is serious (Executive Regulation Arts. 30 and 32).⁩
⁦Answer data subject requests within 45 days, and run a risk assessment before transfers abroad (Executive Regulation Arts. 16 and 37 to 39).⁩

حالیہ تبدیلیاں

⁦Royal Decree No. 68/2026 (3 September 2026, Official Gazette No. 1664) extended the law to data of people in Oman processed abroad, limited⁩ '⁦controller⁩' ⁦to legal persons, rewrote the exemptions and the consent rule, added exceptions to the sensitive-data permit and to consent (Arts. 5 bis and 10 bis), and added a right to object to automated decisions (Art. 14).⁩✓

ذرائع

آزادانہ جانچ کے لیے استعمال ہونے والے ذرائع ⁦(6)⁩

= دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.