Oman. Comprehensive data protection. Law (Royal Decree)
Oman PDPLPersonal Data Protection Law (promulgated by Royal Decree No. 6/2022)
In force
§1Summary
- Synopsis
Oman's comprehensive data protection law, replacing the e-transactions law chapter on data. It requires explicit consent for most processing, mandates a data protection officer, and imposes permits for sensitive data and controls on transfers abroad.
- Key themes
- Unique features
Heavy reliance on express consent; controllers must designate a DPO and appoint MTCIT-licensed external auditors; written consent required before marketing messages. Exempts government bodies and national security processing.
- SaaS relevance
Covers any processing of personal data in Oman; SaaS processors face audit, breach and transfer duties.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- MTCIT within 72h if risk to rights; data subjects within 72h if serious harm
- DPO
- Yes
- Cross-border transfers
- Explicit consent required unless exception; no prejudice to national security; Ministry controls
- Maximum penalty
- OMR 500,000 (most serious violations)
§3Dates
- Key dates
- Adopted
- In force
- Gazette 1429 (13 Feb 2022); in force one year after publication; Executive Regulation 34/2024 in force 5 Feb 2024 with one-year compliance window (to Feb 2025)
§4Text and authority
- Text
- No authoritative text located.
- Authority
- Ministry of Transport, Communications and Information Technology (MTCIT)
§5Where it applies
- Domestic law of
- Oman
§6Sources and verification
- Verification
High confidence.
Fines read from Arabic text: tiers OMR 500–2,000 up to OMR 100,000–500,000.