🇴🇲Personal Data Protection Law, 2022

← Back to laws in Oman

A law built around written approval, Ministry control and transfer discipline

Oman's Personal Data Protection Law was promulgated by Royal Decree No. 6/2022. It replaces the personal data chapter of the Electronic Transactions Law and creates a standalone privacy framework administered by the Ministry of Transport, Communications and Information Technology.

The law is short, but it is not light-touch. It requires explicit approval for processing, written notice before processing begins, special permits for sensitive categories, consent for children's data, a data protection officer, breach notification, confidentiality, written consent for marketing, and regulated cross-border transfers. The most important compliance point is that the controller must be able to prove that the processing is lawful and that the data subject was properly informed.

Effective date and regulatory structure

Royal Decree No. 6/2022 was issued on 9 February 2022 and published in Official Gazette Issue No. 1429. Article IV provides that the decree comes into force after the lapse of one year from the date of publication. Article II requires the Minister of Transport, Communications and Information Technology to issue the executive regulation and necessary implementing decisions.

The regulator is the Ministry of Transport, Communications and Information Technology. Article 7 makes the Ministry responsible for applying the law, preparing and approving controls and procedures, issuing processing controls, receiving complaints, cooperating with foreign authorities, licensing service providers that assess controller and processor compliance, preparing guiding models, publishing periodic reports, and preparing a registry for controllers and processors who meet the conditions set by the Regulation.

The Ministry also has protective powers under Article 8. It may warn a controller or processor, order correction or deletion of unlawfully processed personal data, suspend processing temporarily or permanently, suspend transfers to another country or international organisation, and take other measures necessary to protect personal data as determined by the Regulation.

Scope — what the law covers and what it excludes

Article 2 states that the law applies to personal data that is processed. Article 1 defines personal data as data that directly or indirectly identifies a natural person by reference to identifiers such as name, civil identity number, electronic identification data, spatial data, or factors relating to genetic, physical, mental, psychological, social, cultural or economic identity.

The definition of processing is broad. It includes collecting, recording, analysing, organising, storing, modifying, altering, retrieving, reviewing, coordinating, combining, withholding, deleting, cancelling or disclosing personal data by sending, distributing, transferring or making it available by other means.

Article 3 lists important exclusions. The law does not apply to processing for national security or public interest, public authority functions, legal obligations imposed on the controller, protection of state economic and financial interests, protection of vital interests, detecting or preventing criminal offences based on an official written request, executing a contract with the data subject, personal or family purposes, certain authorised research purposes where the data subject is not identifiable in published outputs, and data made public in a way that is not contrary to the law.

Special-category data and children's data

Article 5 prohibits processing of personal data relating to genetic data, biometric data, health data, ethnic origins, sexual life, political or religious opinions or beliefs, criminal convictions, or data related to security measures unless a permit is obtained from the Ministry in accordance with the Regulation's controls and procedures.

This is a permit-based approach. Explicit consent alone is not enough where Article 5 applies. Organisations processing health data, biometrics, genetic identifiers, criminal conviction data or similar categories need to treat Ministry permission as a separate compliance condition.

Article 6 prohibits processing a child's data except on the basis of the guardian's consent, unless the processing is in the child's best interest. The Regulation is expected to define the controls and procedures for that consent. For online services, educational platforms, health services and apps used by minors, this creates a practical need for age assessment and guardian-consent workflows.

Consent and the form of processing requests

Article 10 is the centre of the Omani processing model. Personal data may not be processed except within a context of transparency, honesty and respect for human dignity and after obtaining the explicit approval of the data subject.

The request for processing personal data must be written in a clear, explicit and understandable manner. The controller must provide proof of the written approval of the data subject for processing their data. This makes consent evidence critical. A vague privacy policy, pre-ticked acceptance box or buried consent clause will be difficult to defend if the controller cannot show clear and explicit written approval.

Article 11 gives the data subject the right to revoke consent to processing without affecting processing that took place before revocation. Controllers should therefore build consent withdrawal into the data lifecycle, not leave it to ad hoc support tickets.

Data subject rights

Article 11 gives the personal data subject a defined set of rights. These include the right to revoke consent, request amendment, updating or withholding of personal data, obtain a copy of processed personal data, transfer personal data to another controller, request deletion unless processing is necessary for national archiving and documentation, and be notified of any breach or violation of personal data and the actions taken.

Article 12 gives the data subject a complaint route. If the data subject considers that processing does not comply with the law, they may complain to the Ministry in accordance with the controls and procedures determined by the Regulation.

These rights mean controllers need a response process. It is not enough to publish rights in a notice. The controller must be able to verify the requester, find the data, amend or withhold it where appropriate, provide a copy, enable transfer, delete where required, and document the response.

Controller and processor obligations

Article 13 requires the controller to set controls and procedures to be followed when processing personal data. These must identify risks to the data subject, set procedures and controls for transferring personal data, establish technical and procedural measures to ensure processing complies with the law, and include any other controls or procedures determined by the Regulation.

Article 14 requires the controller, before processing personal data, to notify the data subject in writing of controller and processor data, contact information for the personal data protection officer, the purpose of processing and source of the data, a comprehensive and accurate description of the processing and its procedures and disclosure levels, the data subject's rights including access, correction, transfer and update, and any other information needed to fulfil processing conditions.

Articles 15 to 18 require the controller and processor to comply with Ministry controls and procedures, appoint an external auditor if requested by the Ministry, provide the Ministry with the auditor's report, maintain documents of processing operations, and cooperate with the Ministry by providing information and documents within the period specified by the Regulation.

Breach notification, confidentiality and marketing

Article 19 requires the controller to notify the Ministry and the personal data subject in case of any breach that leads to destruction, alteration, disclosure, access or illegal processing of personal data, according to the controls and procedures specified in the Regulation.

Article 20 requires the controller to appoint a personal data protection officer. The Regulation is to designate the selection controls and duties of that officer. Article 21 requires the controller to ensure confidentiality of personal data and not disclose it except with prior consent from the data subject as determined by the Regulation.

Article 22 requires the controller to obtain written consent from the data subject before sending advertising or marketing material with commercial purposes. Marketing consent should therefore be separated from general service consent and retained as a written record.

Cross-border transfers — the highest penalty area

Article 23 permits the controller to transfer personal data outside Oman only in accordance with the controls and procedures provided by the Regulation. It also prohibits transfer where the personal data has been processed in violation of the law or where the transfer is likely to cause harm to the data subject.

This is the law's highest monetary exposure. Article 29 imposes a fine of no less than 100,000 Omani Riyals and no more than 500,000 Omani Riyals for violation of Article 23. Organisations using overseas hosting, SaaS tools, regional support centres or cross-border group processing should treat transfer mapping as a priority compliance task.

Penalties

The law has a tiered penalty structure. Violation of Article 14, the pre-processing notice duty, carries a fine from 500 to 2,000 Omani Riyals. Violations of Articles 15, 16, 17, 18, 20 and 22 carry fines from 1,000 to 5,000 Omani Riyals. Violation of Article 13 carries a fine from 5,000 to 10,000 Omani Riyals.

Violations of Articles 5, 6, 19 and 21 carry fines from 15,000 to 20,000 Omani Riyals. Violation of Article 23 carries the highest fine range, from 100,000 to 500,000 Omani Riyals. Legal persons may also be fined from 5,000 to 100,000 Omani Riyals where a crime is committed in their name or for their account by senior officials, with approval, connivance or gross negligence. The court may also order confiscation of instruments used to commit the crime.

Separately, Article 32 permits the Ministry to impose administrative penalties for breaches of the law, the Regulation or implementing decisions, provided that the administrative fine does not exceed 2,000 Omani Riyals.