Oman

The Personal Data Protection Law was issued by Royal Decree 6/2022. It opens with a one-line statement of scope, covering personal data that is used or stored. It then lists a long set of activities that fall outside the law altogether. Those are protecting national security or the public interest. State bodies carrying out their legal functions. Complying with a legal duty or a court ruling. Protecting the state's economic and financial interests. Protecting a vital interest of the person. Detecting or preventing a crime, on a written official request from investigators. Carrying out a contract to which the person is a party. Purely personal or family activity. Historical, statistical, scientific, literary or economic research by authorised bodies, where the output is anonymised. And data that is already lawfully public. The contract exemption is drafted very widely, and we found no official interpretation of it. By contrast, the new Information Technology Crimes Law, issued by Royal Decree 61/2026, applies even if you have no office in Oman. It reaches offences committed wholly or partly outside Oman where they harm Oman's interests or people. It also reaches offences where the criminal result happened, or was meant to happen, in Oman. If you plan to argue that Omani law stops at the border, read that part first.

The general rule sits in the Personal Data Protection Law. The Executive Regulation, issued as Ministerial Decision 34/2024, fills it out. Consent is not needed in two narrow cases. One is where the transfer carries out an international treaty duty Oman has signed. The other is where the data has been stripped of identity so completely that nobody can link it back to the person. The written assessment must cover several things. The nature, volume and sensitivity of the data. The purpose and scope of the work, and who else will see the data. How long the work lasts, and whether it is one-off or routine. The stages of the journey, including every country the data passes through and its final destination. And the effects and risks for the person. Here is the position sector by sector, hardest rule first. Government: hardest. The ministry's Cloud and Hosting Services Standard tells government agencies that government data and information may only be hosted, transacted or handled inside Oman's geographical boundaries. That includes primary storage and backup or disaster recovery. A June 2026 circular now also requires government bodies to classify data before it is put into any cloud. Sensitive personal data: you may not touch health, genetic, biometric, ethnic origin, sex life, political or religious opinions, beliefs or criminal convictions without a permit from the ministry. The permit application must list the places where the data will be stored or transferred. So storage location becomes a licensed matter rather than a private choice. Telecommunications: we found no storage rule. But an internet service provider may not disclose subscriber data to anyone except on an order from the competent court. That blocks routine group-wide sharing with a foreign parent. Banking, insurance and securities: not verified, see the unconfirmed list. Health, education, gambling and mapping: we found no separate storage rule on official sources, checked 18 August 2026, confidence medium.

The permit route works like this. You apply to the ministry with the name and contact details of your data protection officer. You give the purpose of your work with the data, and a description and classification of the data. You name the supplier who will handle it for you, and any third party you will disclose it to. You list the places where the data will be transferred or stored. You describe your data management and protection systems. You attach your privacy policy and your plan for handling a breach. The competent department has forty-five days to decide, counted from the date your file is complete. Silence for forty-five days counts as a refusal. A refusal must give reasons. You can appeal to the Minister within sixty days, and silence on that appeal for thirty days is again a refusal. The Minister issues the permit for up to five years against payment of a fee, and it is renewable. You must report any change to the permit details within fifteen days. The permit can be cancelled for three reasons. You break the law or the regulation. You miss that fifteen-day deadline. Or it turns out the permit was obtained by fraud or false information. Note also the reverse power. The ministry can order you to stop transferring personal data to a named country or international organisation.

The law names the ministry as the body responsible for applying it. It says this is without prejudice to the powers of the Cyber Defence Centre, which was created by Royal Decree 64/2020. The regulation defines the competent department as the ministry's own personal data protection administration. Officials named by decision can be given the status of judicial enforcement officers. That is what allows evidence gathering rather than mere correspondence. The ministry has a range of powers. It can warn an organisation. It can order data corrected or erased. It can suspend the use of data temporarily or permanently. It can halt transfers to a country or international organisation. It can suspend or cancel a permit. And it can impose administrative fines of up to two thousand Omani rials, roughly five thousand two hundred United States dollars, per violation. Larger money penalties are criminal court fines under the law itself, not administrative ones. Complaints run to fixed clocks. A complaint must be brought within thirty days of the complainant learning of the violation. The department passes it to the organisation within seven days. The organisation has fourteen days to answer. The department then has sixty days to decide, and silence counts as a rejection. The Cyber Defence Centre is a separate matter. Both the privacy law and the 2026 technology crimes law expressly preserve its powers. But we found no public website, published decision or contact channel for it, so its real role is unknown rather than absent. The telecommunications regulator and the tax authority are visibly working and publish current material.

The privacy regulation says the reason for keeping records must be specific and lawful. The keeping period must match the purpose. The records must be technically protected while held. You must keep records of what you do with personal data, continuously, and hand them to the competent department on request. Those records must include the categories of data, who may access it, the periods and limits for using it, and how it is deleted and corrected. They must also include who the data is disclosed to and why. They must cover details of anyone the data is transferred to, and anything about movement of data across the border. They must cover the security measures in place. And they must cover every breach, with its circumstances, effects and the remedy applied. Breach records must be kept for whatever period the competent department sets. On the deletion side, a person may demand erasure where the purpose has ended, where they have withdrawn consent, or where you broke the rules. You may refuse only to comply with a law, a court ruling or judgment, or where there is a live dispute with that person. The law also excludes data needed for national preservation and documentation purposes from the erasure right. You must answer requests within forty-five days.

The report to the ministry must describe the nature of the data involved and the consequences. It must give contact details for follow-up. It must describe the likely effects. It must set out the corrective, technical and organisational steps you will take, including anything proposed to soften the impact. And it must state what you already did between discovering the breach and reporting it. Reports go to the personal data protection address published by the ministry. After a report the department may log it. It may assess whether your response actually meets the harm. It may direct you to notify the affected people, and offer guidance or support. The notice to individuals must state the type and nature of the breach, which of their data was hit, and recommendations for limiting the damage. Separately you must keep an internal breach file with causes, consequences and remedies, held for as long as the department requires. A breach is defined as unlawful access to personal data leading to its destruction, alteration, disclosure, access or unlawful use. Breaking the breach reporting duty carries a court fine of fifteen thousand to twenty thousand Omani rials, roughly thirty-nine thousand to fifty-two thousand United States dollars. A second, separate reporting duty may exist towards the Cyber Defence Centre, whose powers the law preserves. We found no published incident reporting rule for it.

More detail on each. The Minister grants the permit for up to five years, and you must report changes within fifteen days or risk losing it. The heavy transfer fine sits in the law's criminal chapter. Alongside it sit fifteen thousand to twenty thousand rials for breaking the sensitive data, children, breach reporting or confidentiality duties. Then five thousand to ten thousand rials for other listed duties, and five hundred to two thousand rials at the bottom of the scale. A company can be fined five thousand to one hundred thousand rials, about thirteen thousand to two hundred and sixty thousand United States dollars. That applies where an offence was committed in its name by a chairman, board member, manager or other officer, with their consent, cover-up or gross negligence. It does not displace the personal liability of those individuals. A court may also confiscate the equipment used. On children, the guardian's clear consent is required, and no disclosure or sharing of a child's data is allowed without it. The law does not define the age at which someone stops being a child, so you have to assume the general Omani age of majority. On day-to-day work, expect three clocks. Forty-five days for answering individual rights requests. Thirty days for handing documents to the ministry when asked. And sixty days from appointing an external auditor to file the report. Finally, an internet service provider in Oman may not hand over subscriber data except on an order of the competent court. That catches groups who expect their Omani subsidiary to answer a parent company request.

Recent and current rules, most recent first. Cloud Computing First Circular 10/2026, dated 28 June 2026, updates the cloud-first policy for government digital projects. It requires cloud providers to hold approved certifications before contracting. It requires government bodies to classify data before storing or using it in a cloud. The Information Technology Crimes Law, issued by Royal Decree 61/2026, was published on 1 June 2026. It replaced the previous technology crimes law and took effect the day after publication. It allows the ministry to obtain electronic data from government and non-government bodies inside Oman and outside it. The ministry must coordinate with other authorities, and must have an order from the public prosecution or the competent court. A ministerial circular of 14 January 2025 set up national rules for data governance and management across government bodies. A new Electronic Transactions Law was issued by Royal Decree 39/2025 in April 2025. Some powers can be used without warning. The ministry can stop transfers to a named country or international organisation. It can suspend or cancel a permit. It can order an external audit by a ministry-licensed auditor. And it can rewrite the executive regulation by ministerial decision, with no new legislation.