Oman. Comprehensive data protection. Ministerial Decision
Oman PDPL Executive RegulationExecutive Regulation of the Personal Data Protection Law (Ministerial Decision No. 34/2024)
In force
§1Summary
- Synopsis
Implements the Oman PDPL with detailed rules on permits, records of processing, external audits, breach notification, marketing consent and conditions for transferring data outside Oman.
- Key themes
- Unique features
Article 37 requires explicit consent before transfer abroad unless an exception applies (treaty obligation, etc.); MTCIT-licensed external auditors with audit reports within 60 days.
- SaaS relevance
Sets the operational compliance tasks for SaaS processing Omani data, enforced from Feb 2025.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- MTCIT ≤72h; individuals ≤72h if serious harm
- DPO
- Yes
- Cross-border transfers
- Explicit consent or listed exceptions
- Maximum penalty
- As PDPL
§3Dates
- Key dates
- Adopted
- In force
- Gazette 1531 (4 Feb 2024); in force next day; one-year adjustment period to early Feb 2025
§4Text and authority
- Text
- No authoritative text located.
- Authority
- MTCIT
§5Where it applies
- Domestic law of
- Oman
§6Sources and verification
- Verification
High confidence.