Oman

The Personal Data Protection Law issued by Royal Decree 6/2022 opens with a one-line scope provision covering personal data that is processed, then sets out a long list of processing that falls outside the law altogether: protecting national security or the public interest, state bodies carrying out their legal functions, complying with a legal obligation or a court ruling, protecting the state's economic and financial interests, protecting a vital interest of the person, detecting or preventing a crime on a written official request from investigators, performing a contract to which the person is a party, purely personal or family activity, historical, statistical, scientific, literary or economic research by authorised bodies where the output is anonymised, and data already lawfully public. The contract exemption is drafted very widely and no official interpretation of it was found. By contrast, the new Information Technology Crimes Law issued by Royal Decree 61/2026 is expressly extraterritorial: it reaches offences committed wholly or partly outside Oman where they harm Oman's interests or people, or where the criminal result happened or was meant to happen in Oman. Anyone relying on the argument that Omani law stops at the border should read that provision first.

The general rule sits in the Personal Data Protection Law and is filled out by the Executive Regulation issued as Ministerial Decision 34/2024. Consent is not needed in two narrow cases: where the transfer carries out an international treaty obligation Oman has signed, and where the data has been stripped of identity so completely that nobody can link it back to the person. The written assessment must cover the nature, volume and sensitivity of the data, the purpose and scope of processing and who else will see it, how long processing lasts and whether it is one-off or routine, the stages of the journey including every country the data passes through and its final destination, and the effects and risks for the person. Sector picture, in order of how hard the wall is. Government: hardest. The ministry's Cloud and Hosting Services Standard tells government agencies that government data and information may only be hosted, transacted or processed inside Oman's geographical boundaries, primary storage and backup or disaster recovery included, and a June 2026 circular now also requires government bodies to classify data before it is put into any cloud. Sensitive personal data: health, genetic, biometric, ethnic origin, sex life, political or religious opinions, beliefs and criminal convictions may not be processed at all without a permit from the ministry, and the permit application must list the places where the data will be stored or transferred, so storage location becomes a licensed matter rather than a private choice. Telecommunications: no storage rule was found, but an internet service provider may not disclose subscriber data to anyone except on an order from the competent court, which blocks routine group-wide sharing with a foreign parent. Banking, insurance and securities: not verified, see the unconfirmed list. Health, education, gambling and mapping: no separate storage rule found on official sources, checked 18 August 2026, confidence medium.

The permit route works like this. You apply to the ministry with the name and contact details of your data protection officer, the purpose of processing, a description and classification of the data, the processor you will use, any third party you will disclose to, the places where the data will be transferred or stored, and your data management and protection systems, and you attach your privacy policy and your plan for handling a breach. The competent department has forty-five days to decide from the date your file is complete; silence for forty-five days counts as a refusal. A refusal must give reasons and can be appealed to the Minister within sixty days, and silence on that appeal for thirty days is again a refusal. The permit is issued by the Minister for up to five years against payment of a fee, and is renewable. You must report any change to the permit details within fifteen days. The permit can be cancelled if you break the law or the regulation, if you miss that fifteen-day deadline, or if it turns out the permit was obtained by fraud or false information. Note also the reverse power: the ministry can order the transfer of personal data to a named country or international organisation to stop.

The law names the ministry as the body responsible for applying it, expressly without prejudice to the powers of the Cyber Defence Centre, which was created by Royal Decree 64/2020. The regulation defines the competent department as the ministry's own personal data protection administration. Officials designated by decision can be given the status of judicial enforcement officers, which is what allows evidence gathering rather than mere correspondence. The ministry can warn an organisation, order data corrected or erased, suspend processing temporarily or permanently, halt transfers to a country or international organisation, suspend or cancel a permit, and impose administrative fines of up to two thousand Omani rials, roughly five thousand two hundred United States dollars, per violation. Larger money penalties are criminal court fines under the law itself, not administrative ones. Complaints run to fixed clocks: a complaint must be brought within thirty days of the complainant learning of the violation, the department passes it to the organisation within seven days, the organisation has fourteen days to answer, and the department then has sixty days to decide, with silence counting as a rejection. The Cyber Defence Centre is a separate matter: its powers are expressly preserved by both the privacy law and the 2026 technology crimes law, but no public website, published decision or contact channel for it was found, so its practical role is unknown rather than absent. The telecommunications regulator and the tax authority are visibly operational and publish current material.

The privacy regulation says the reason for keeping processing records must be specific and lawful, the period must match the purpose of processing, and the records must be technically protected while held. Records of processing activities must be kept continuously and handed to the competent department on request, and they must include the categories of data, who may access it, processing periods and limits, deletion and correction methods, who the data is disclosed to and why, details of anyone the data is transferred to, anything about movement of data across the border, the security measures in place, and every breach with its circumstances, effects and the remedy applied. Breach records must be kept for whatever period the competent department sets. On the deletion side, a person may demand erasure where the purpose has ended, where they have withdrawn consent, or where processing broke the rules, and the organisation may refuse only to comply with a law, a court ruling or judgment, or where there is a live dispute with that person. The law also carves out data needed for national preservation and documentation purposes from the erasure right. Requests must be answered within forty-five days.

The report to the ministry must describe the nature of the data involved and the consequences, give contact details for follow-up, describe the likely effects, set out the corrective, technical and organisational steps you will take including anything proposed to soften the impact, and state what you already did between discovering the breach and reporting it. Reports go to the personal data protection address published by the ministry. After a report the department may log it, assess whether your response actually meets the harm, direct you to notify the affected people, and offer guidance or support. The notice to individuals must state the type and nature of the breach, which of their data was hit, and recommendations for limiting the damage. Separately you must keep an internal breach file with causes, consequences and remedies, held for as long as the department requires. A breach is defined as unlawful access to personal data leading to its destruction, alteration, disclosure, access or unlawful processing. Breaking the breach reporting duty carries a court fine of fifteen thousand to twenty thousand Omani rials, roughly thirty-nine thousand to fifty-two thousand United States dollars. A second, separate reporting duty may exist towards the Cyber Defence Centre, whose powers the law preserves, but no published incident reporting rule for it was found.

More detail on each. The permit is granted by the Minister for up to five years and you must report changes within fifteen days or risk losing it. The heavy transfer fine sits in the law's criminal chapter, alongside fifteen thousand to twenty thousand rials for breaking the sensitive data, children, breach reporting or confidentiality duties, five thousand to ten thousand rials for other listed duties, and five hundred to two thousand rials at the bottom of the scale. A company can be fined five thousand to one hundred thousand rials, about thirteen thousand to two hundred and sixty thousand United States dollars, where an offence was committed in its name by a chairman, board member, manager or other officer with their consent, cover-up or gross negligence, and this does not displace the personal liability of the individuals. A court may also confiscate the equipment used. On children, the guardian's clear consent is required and no disclosure or sharing of a child's data is allowed without it, but the law does not define the age at which someone stops being a child, so the general Omani age of majority has to be assumed. On operations, expect a forty-five day clock for answering individual rights requests, a thirty day clock for handing documents to the ministry when asked, and sixty days from appointing an external auditor to file the report. Finally, an internet service provider in Oman may not hand over subscriber data except on an order of the competent court, which catches groups that expect their Omani subsidiary to answer a parent company request.

Recent and current instruments, most recent first. Cloud Computing First Circular 10/2026, dated 28 June 2026, updates the cloud-first policy for government digital projects, requires cloud providers to hold approved certifications before contracting, and requires government bodies to classify data before storing or processing it in a cloud. The Information Technology Crimes Law issued by Royal Decree 61/2026 was published on 1 June 2026, replaced the previous technology crimes law, and took effect the day after publication; it allows the ministry, coordinating with other authorities and on an order from the public prosecution or the competent court, to obtain electronic data from government and non-government bodies inside Oman and outside it. A ministerial circular of 14 January 2025 put in place a regulatory framework for national data governance and management across government bodies. A new Electronic Transactions Law was issued by Royal Decree 39/2025 in April 2025. Dormant switches to watch, each usable without warning: the power to stop transfers to a named country or international organisation, the power to suspend or cancel a processing permit, the power to order an external audit by a ministry-licensed auditor, and the ability to rewrite the executive regulation by ministerial decision without new legislation.