Data Protection in Oman

Data Protection in Oman

The firm covers Oman matters in cooperation with a partner office in the Sultanate of Oman. That partner office is not a branch owned by the firm, and the firm does not itself hold an Oman law practice license; local licensing and representation are assessed for each matter in the Sultanate. Personal data in Oman is governed by the Personal Data Protection Law issued by Royal Decree No. 6/2022, which came into force one year after its issuance in February 2022, and by its Executive Regulation, issued by Ministerial Decision No. 34/2024. The Ministry of Transport, Communications and Information Technology applies the law, without prejudice to the competences of the Cyber Defence Centre. With our partner office we place the entity under the law: whether it is a controller or a processor, and what it must obtain, document or erase.

Consent and the controller's duties

Processing, or a change of its purpose, needs the data subject's explicit consent, within a framework of transparency, honesty and respect for human dignity, except in the cases the law lists. The controller must set controls and procedures that identify the risks to the individual and govern transport and transfer of data. It must erase data as soon as the purpose ends, keeping it only while a dispute with the individual is open or a law, judgment or order requires. Where processing is automated, the individual can object and the decision must be reviewed by a person. On the ministry's request, the controller and processor must appoint an external auditor to verify compliance.

Sensitive data, rights and marketing

Genetic, biometric and health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions and security measures cannot be processed without a permit from the ministry, issued under the controls in the Executive Regulation. Individuals have rights of access and correction, can object, and can have their data transferred to another controller. Commercial advertising or marketing material may be sent only with the individual's explicit consent.

Transfers abroad and penalties

A controller may move personal data outside Oman under the controls and procedures set by the Executive Regulation, without prejudice to the Cyber Defence Centre's competences. The law sets fines by article, from OMR 500 up to OMR 500,000 for breaches of the transfer rule, and the ministry can also impose administrative penalties. To scope an Omani compliance file, see General Commercial & Corporate or contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has a branch in Cairo. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE and Qatar, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Which law governs personal data in Oman?

The Personal Data Protection Law issued by Royal Decree No. 6/2022, with its Executive Regulation issued by Ministerial Decision No. 34/2024. The Ministry of Transport, Communications and Information Technology applies it.

Does sensitive data need a permit in Oman?

Yes. Genetic, biometric and health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions and security measures cannot be processed without a permit from the ministry.

Who handles Oman data protection matters at the firm?

Oman matters are handled in cooperation with the firm's partner office in the Sultanate. The firm does not itself hold an Oman law practice license, and local licensing and representation are assessed for each matter.

Other markets

Corporate & Commercial Law in Oman · Data Protection in Egypt · Data Protection in Saudi Arabia · Data Protection in the UAE · Data Protection in Qatar · Data Protection in Bahrain