What Your Chatbot Does With Customer Data: Consent, Logs and Cross-Border Transfers Under Oman's Law

A business chatbot processes personal data from its first message: a phone number, a name, an order reference, and whatever customers choose to type. Under Oman’s Personal Data Protection Law, as amended in September 2026, that brings five obligations:

1. a lawful basis — explicit consent requested with specific content, or one of four exceptions;
2. a data protection policy people can see before you process;
3. transfer rules whenever messages go to a model or platform hosted outside Oman;
4. erasure of conversation data once its purpose ends;
5. a right to object, with human review, if the bot makes decisions about people.

The transfer rule is the expensive one. Most language models are reached through APIs hosted abroad. Sending personal data to them is a transfer outside the Sultanate, and an unlawful transfer carries the Law’s heaviest fine: OMR 100,000 to 500,000.

This article covers what that means for a chatbot’s design. The general obligations are in the seven things Oman’s PDPL changes inside your systems.

The short answer

Obligation	Where it comes from	What it means for a chatbot
Lawful basis	Law Articles 10 and 10bis	Explicit consent with the required content, or a customer contract that says processing follows the Law
Information before processing	Executive Regulation Article 21; Law Article 10	A visible data protection policy and a short notice at the start of the chat
Transfers abroad	Law Article 23; Regulation Articles 37–40	Explicit consent or anonymisation, an adequacy check, and a written assessment of each foreign recipient
Erasure	Law Article 15	Delete transcripts when their purpose ends, unless a dispute or legal obligation applies
Automated decisions	Law Article 14	Objection route and human review for anything the bot decides
Breaches	Law Article 19; Regulation Articles 30–32	72-hour notification to the Ministry where rights are threatened
Sensitive data and children	Law Articles 5 and 6; Regulation Articles 11–15	Permit for sensitive categories; guardian’s explicit consent for children

Every chatbot is a personal data system

It helps to list what actually flows through one:

• Identifiers. On WhatsApp, the customer’s phone number arrives with every message. On a website, the account login, email address or IP address.
• Conversation content. Order numbers, addresses, complaints — and things customers volunteer without being asked, such as ID numbers, medical details or family circumstances.
• Metadata. Timestamps, device information, location hints.
• Derived data. Summaries, tags, intent labels and sentiment scores your system creates.

Then list who touches it. That includes the messaging channel, the chatbot platform if you use one, and the model provider. It also includes your hosting, any analytics or monitoring tools, and the staff who read transcripts. Each one that processes data on your behalf belongs in your processor register. Each one outside Oman engages the transfer rules.

The lawful basis: consent, or a contract that says so

Since 7 September 2026, Article 10 requires explicit consent that you must be able to prove. The request must be clear, explicit and understandable, and must include four things:

1. your details and those of any processor;
2. how to contact your data protection officer;
3. the objectives and nature of the processing;
4. anything else needed to meet the Law’s conditions.

The Executive Regulation accepts consent given electronically, from a person with full legal capacity, clearly and without coercion.

For a chatbot that means a short consent step before the conversation collects anything beyond the question itself. Store a record of who agreed, to which wording, and when.

The alternative is the contract route in the new Article 10bis. Processing is permitted without consent when it performs a contract the customer is party to — provided the contract states that the processing is carried out in accordance with the Law. If your customer terms carry that language, a chatbot helping an existing customer with their order can rely on it. Customer terms written before September 2026 rarely do. What Royal Decree 68/2026 changed explains the amendment.

Marketing is separate. Article 22 requires explicit consent before sending any commercial advertising or marketing material. A chatbot that pushes offers to customers who contacted you about a delivery needs that consent, plus a working way to stop.

Tell people before you process

Article 21 of the Executive Regulation requires the controller to publish its data protection policy in a visible place, so people can read it before their data is processed. The policy must explain how they exercise their rights.

For a chatbot, a practical opening message does four jobs in two or three lines:

• it says the customer is talking to an AI assistant and can reach a person;
• it links to the data protection policy;
• it says how to contact the data protection officer;
• it asks for consent where you rely on consent, including consent to transfer if messages go abroad.

The transfer question: where does each message go?

This is where chatbot designs are most exposed.

If the model runs on servers outside Oman — as most hosted models do — each message containing personal data is transferred outside the Sultanate. The same applies to a chatbot platform hosted abroad, and often to the analytics behind it.

The Executive Regulation sets the conditions:

• Article 37: before transferring personal data abroad, obtain the data subject’s explicit consent. The transfer must also not prejudice national security or the State’s higher interests. Consent is not required where the transfer fulfils an international agreement Oman is party to, or where the data has been made anonymous so it cannot be linked to the person by any means.
• Article 38: before transferring, ensure the foreign recipient provides protection not lower than Oman’s Law and Regulation.
• Article 39: carry out a written assessment covering the nature, volume and sensitivity of the data; the purpose, scope and recipients; the duration and frequency; the route and final destination; and the risks to the data subject.
• Article 40: the Ministry may ask for a copy of that assessment.

Breaching the transfer rule under Article 23 of the Law carries a fine of OMR 100,000 to 500,000.

Five design decisions reduce the exposure:

1. Send less. The model rarely needs the customer’s name, phone number or ID number to answer a policy question. Strip or mask identifiers before the message leaves your system, and keep the mapping on your side.
2. Keep lookups local. When the bot checks an order, let your own system fetch the record and send the model only the fields needed to phrase the answer.
3. Choose providers and regions deliberately. Where in-country or nearby hosting is available for the components that handle personal data, weigh it against the transfer work it saves. Where your company’s data is allowed to live covers Oman’s hosting rules.
4. Get consent that covers the transfer where personal data must still leave, in the opening notice, in plain words.
5. Do the Article 39 assessment once per provider, keep it on file, and update it when the provider changes regions or sub-processors.

What to check in the model provider’s terms

The model provider is your processor, so its terms are part of your compliance. Read four things:

• Training. Business terms commonly exclude training on your inputs and outputs. Anthropic’s Commercial Terms, for example, state that it “may not train models on Customer Content from Services”. Consumer apps are governed by different terms, which is why staff should not use personal accounts for business data.
• Retention. How long inputs and outputs are kept, and whether shorter or zero retention is available.
• Location and sub-processors. Where processing happens, and who else is involved.
• Breach notification and deletion. Notice timing that lets you meet your own 72-hour obligation, and confirmation of deletion at the end.

Transcripts, logs and erasure

Conversation logs are valuable for quality review and for disputes, and they are personal data. Since September 2026, Article 15 requires personal data to be erased immediately once its purpose ends. It may be kept only for an existing dispute or a legal obligation.

• Set a retention period for transcripts tied to a stated purpose, such as dispute handling and quality review, and delete automatically when it expires.
• Place legal holds on conversations under dispute.
• Redact what you never needed. Mask ID numbers, card numbers and health details that customers volunteered.
• Restrict who can read transcripts, and log that access. Who can see what covers the design.
• Include transcripts in access requests. When a customer asks for a copy of their data, which the Regulation requires you to decide on within 45 days, the conversations are part of it.

Sensitive data and children

Health and other sensitive categories. Article 5 still requires a Ministry permit to process genetic, biometric and health data, among other sensitive categories. A clinic booking bot that asks about symptoms is processing health data. Since September 2026 the definition of health data has expressly included data about the provision of health care services that reveals a person’s health status. Design the bot to collect only what the booking needs, and check whether you need a permit before launch.

Children. Processing a child’s personal data requires the guardian’s approval unless the processing is in the child’s best interest (Article 6 of the Law), and the Regulation requires that approval to be explicit consent (Article 11). A chatbot for a school, a children’s activity or an education platform needs an age check and a guardian-consent path.

Automated decisions

If the bot approves, refuses or cancels anything — a refund, a booking, an application — Article 14 now gives the customer the right to object. A person must then review the decision. Build the objection into the conversation (“If you disagree with this decision, reply OBJECT and a member of our team will review it”) and route it to a human queue. When your chatbot gets it wrong covers the liability side.

Breaches

Chatbots create new ways for data to leak. A transcript store can be exposed, a misconfigured tool can return another customer’s order, or a prompt-injection attack can coax the bot into revealing data. If a breach threatens customers’ rights, you must notify the Ministry’s competent department within 72 hours of becoming aware. You must also tell affected customers within the same period where the harm may be serious. Your vendors’ contracts must give you notice fast enough to do that.

A checklist for a lawful chatbot in Oman

1. Opening notice: AI disclosure, human route, policy link, DPO contact.
2. Consent record — or customer terms that state processing follows the Law.
3. Separate explicit consent for any marketing.
4. Identifiers stripped before messages go to an external model.
5. Article 39 transfer assessment on file for every foreign provider.
6. Provider terms checked for training, retention, location, sub-processors and breach notice.
7. Transcript retention period, automatic deletion and legal holds.
8. Transcript access restricted and logged.
9. Objection and human review for any automated decision.
10. Permit check for health or other sensitive data; guardian consent for children.

---

Frequently asked questions

Do we need customer consent to use a chatbot in Oman? You need a lawful basis. That is explicit consent with the content Article 10 requires, or one of the Article 10bis exceptions. The most relevant exception is a contract with the customer that states the processing complies with the Law. Marketing messages need explicit consent regardless.

Is using an AI model hosted abroad a data transfer under Oman’s law? If the messages contain personal data, yes. The Executive Regulation requires explicit consent before the transfer, unless the data is anonymised or an international agreement applies. You must also ensure the recipient’s protection is not lower than Oman’s, and keep a written assessment the Ministry can request.

What is the fine for transferring personal data abroad unlawfully? OMR 100,000 to 500,000 under Article 29 of the Law, for breach of the transfer rule in Article 23. It is the heaviest penalty band in the Law.

How long can we keep chatbot transcripts? Only as long as a stated purpose requires, then erase them. Since 7 September 2026, Oman’s law requires erasure once the purpose ends, unless an existing dispute or a legal obligation requires retention.

Will the model provider use our customers’ conversations to train its models? That depends on the terms you accept. Business API terms commonly exclude training on customer content, while consumer apps may not. Check the specific terms, and keep business use on business accounts.

Can a chatbot for a clinic ask patients about symptoms? That is health data, which is a sensitive category requiring a Ministry permit unless an exception applies. Collect only what the booking needs, and check the permit question before launch.

---

This article states the position under the Personal Data Protection Law as amended by Royal Decree 68/2026, and its Executive Regulation, as in force on 21 October 2026, the date of publication. It is not legal advice; confirm your position with a qualified adviser.

Sources: Royal Decree 68/2026 amending the Personal Data Protection Law · Royal Decree 6/2022 — Personal Data Protection Law (Arabic text) · Ministerial Decision 34/2024 — Executive Regulation (Arabic text) · Anthropic — Commercial Terms of Service · OWASP — Top 10 for LLM Applications

Building a chatbot that handles customer data lawfully? ZAWAT builds AI and automation with identifier masking, consent records, retention and transfer documentation designed in. Book a call.