Does GDPR Apply to a Company in Oman or the Gulf? The Article 3 Test, Explained
The EU’s General Data Protection Regulation (GDPR) applies to a company in Oman or elsewhere in the Gulf in three situations. The first is having an establishment in the EU. The second is offering goods or services to people who are in the EU. The third is monitoring the behaviour of people while they are in the EU.
The test is where the person is, not their nationality. A German tourist buying from your shop in Muscat does not bring GDPR with them. A website in German that ships to Hamburg may well do so.
If GDPR applies, you usually need a representative in the EU, and you face fines of up to €20 million or 4% of worldwide annual turnover for the most serious breaches.
There is also a fourth, more common way GDPR reaches Gulf companies, and it involves no EU customers of your own: working as a processor for a European client. That case is covered below.
The short answer
| Your situation | Does GDPR apply? | What follows |
|---|---|---|
| Office, branch or subsidiary in the EU | Yes, to processing in the context of that establishment’s activities, wherever it takes place | Full GDPR obligations for that processing |
| No EU presence, but you target customers in the EU | Yes (Article 3(2)(a)) | GDPR obligations, plus an EU representative in most cases |
| No EU presence, but you track or profile people in the EU | Yes (Article 3(2)(b)) | As above |
| An EU company hires you to process data for it | Its obligations reach you by contract; transfers to you need a legal mechanism | A data processing agreement and, usually, standard contractual clauses |
| Your website is simply reachable from Europe | Not on that basis alone | Nothing GDPR-specific follows |
Offering goods or services: what “targeting” means
Article 3(2)(a) covers controllers and processors outside the EU that offer goods or services to data subjects in the Union, whether or not payment is required. The question is intention. Did you envisage offering to people in the EU?
GDPR’s recitals and the European Data Protection Board’s guidelines on territorial scope give the indicators. Mere accessibility of a website, an email address or a phone number is not enough. Signals that do count include:
- using a language or currency of an EU member state with the option to order in it;
- delivering goods to EU addresses;
- mentioning customers or users who are in the EU;
- paying for search or advertising campaigns aimed at EU audiences;
- using an EU country-code domain such as
.deor.fr.
No single signal decides the question; the overall picture does. An Omani e-commerce store in Arabic and English, priced in rials, shipping within the GCC, is not targeting the EU. The same store adding euro pricing and a “free delivery to Germany” banner is.
Monitoring behaviour: tracking, not merely counting
Article 3(2)(b) covers monitoring the behaviour of people in the EU, as far as that behaviour takes place in the Union. The recitals point to tracking people online to profile them — to make decisions about them, or to analyse or predict their preferences, behaviour and attitudes.
Behavioural advertising aimed at European visitors, cross-site tracking, and personalisation built on browsing histories can all qualify. The EDPB’s guidance is that not every online collection or analysis of personal data counts as monitoring; the purpose matters. Basic aggregate statistics on your own site are a weaker case than profiling a visitor across sessions.
Establishment: when a small presence counts
Article 3(1) applies GDPR to processing in the context of the activities of an establishment in the EU, regardless of where the processing happens. An establishment means a real and effective activity through stable arrangements. A branch or subsidiary qualifies, and in some circumstances a much lighter presence can too.
If your group has any European entity, check what that entity does with personal data before concluding GDPR is someone else’s problem.
The likelier route: processing for a European client
You can be fully outside Article 3 and still work under GDPR terms. Suppose a European company hires an Omani firm to build or run a system holding its customers’ data. The European company is the controller and you are its processor. It must sign a contract with you that meets Article 28.
That contract obliges you to act only on its documented instructions, keep the data confidential, secure it, use sub-processors only with authorisation, help it answer data subject requests, and delete or return the data at the end.
The data also leaves the EU when it reaches you. The European Commission has not adopted an adequacy decision for any GCC state, so the transfer needs another mechanism under Chapter V — most commonly the Commission’s standard contractual clauses. Your client will ask you to sign them, together with a transfer impact assessment describing Omani law and your safeguards.
If you sell software or services to European companies, this is the route by which GDPR is most likely to reach you. It is worth having a standard processing agreement ready rather than negotiating one under deadline. Hiring a software company without handing over your data covers the same clauses from the buyer’s side.
If GDPR applies to you: the obligations that change your systems
A lawful basis for each purpose. GDPR offers six: consent, contract, legal obligation, vital interests, public task and legitimate interests. That is broader than Oman’s consent-led law. A system serving both markets should record the basis per purpose and per jurisdiction.
Transparency. Articles 13 and 14 set out what people must be told when you collect their data: who you are, why you process, on what basis, for how long, who receives it, and what rights they have.
Rights, answered within one month. Access, rectification, erasure, restriction, portability and objection. Article 12 requires a response without undue delay and within one month, extendable by two further months for complex requests.
Data protection by design and by default. Article 25 requires appropriate technical and organisational measures from the design stage onward. See privacy by design in custom software for what that means in a codebase.
Records, security and breach notification. Article 30 records of processing; Article 32 security appropriate to the risk. Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk. Article 34 requires telling individuals where the risk is high.
Automated decisions. Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects — subject to exceptions with safeguards.
An EU representative. Article 27 requires a controller or processor covered by Article 3(2) to designate a representative in the EU in writing. The exception is processing that is occasional, does not involve special categories on a large scale, and is unlikely to result in a risk.
A DPO in defined cases. Article 37 requires one where core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories.
Fines
Article 83 sets two tiers. Infringements of obligations such as by-design measures, records, security, breach notification and the representative duty can reach €10 million or 2% of total worldwide annual turnover of the preceding year, whichever is higher. Infringements of the basic principles, lawful basis and consent rules, data subject rights and transfer rules can reach €20 million or 4%.
GDPR and Oman’s law side by side
| Topic | GDPR | Oman PDPL (as amended 2026) |
|---|---|---|
| Lawful bases | Six, including legitimate interests | Explicit consent, plus four listed exceptions |
| Breach notification | Authority within 72 hours unless unlikely to pose a risk | Competent department within 72 hours where rights are threatened |
| Automated decisions | Right not to be subject to solely automated decisions with significant effects | Right to object to automated decisions, with human review |
| Erasure | On grounds such as consent withdrawal; storage limitation principle | Immediately when the purpose ends, unless a dispute or legal obligation |
| International transfers | Adequacy, safeguards such as SCCs, or derogations | Explicit consent before transfer, or listed exceptions, plus an assessment |
| DPO | In defined cases | Every controller designates one |
| Reach abroad | Targeting or monitoring people in the EU | Personal data of people in Oman, processed inside or outside |
The practical lesson is that neither law is a superset of the other. A system built only for GDPR could rely on legitimate interests that Oman does not recognise. A system built only for Oman has no answer to a European regulator asking about your representative. Oman’s 2026 amendments narrowed the gap on automated decisions and erasure, but did not close it.
Pending changes in Brussels
In November 2025 the European Commission proposed a “Digital Omnibus” package that would amend GDPR. The proposals include raising the breach notification threshold to high-risk breaches with a 96-hour deadline, and moving cookie rules into GDPR. At the time of writing the proposal was still before the European Parliament and the Council. The 72-hour rule and the current cookie rules still apply.
Frequently asked questions
Does GDPR apply to my company in Oman if I have European customers? Only if you are established in the EU, deliberately offer goods or services to people in the EU, or monitor their behaviour there. Selling to Europeans while they are in Oman does not trigger GDPR by itself.
My website is in English and visible in Europe. Is that targeting? Not on its own. English is not tied to any one EU member state, and being reachable is not enough. Look at the whole picture: currency, delivery, advertising, domains and explicit mentions of EU customers.
Do I need an EU representative? If GDPR applies to you under Article 3(2), yes, unless your processing is occasional, involves no large-scale special category data, and is unlikely to result in a risk. The representative must be designated in writing and be established in a member state where your data subjects are.
A European client wants me to sign standard contractual clauses. Why? Because no GCC state has an EU adequacy decision, so personal data sent to you in Oman needs a transfer mechanism. Standard contractual clauses are the usual one, and clients normally ask for a transfer impact assessment as well.
Is GDPR stricter than Oman’s law? On some points and not others. GDPR allows legitimate interests and Oman’s law does not. Oman requires every controller to designate a DPO and erases data immediately when its purpose ends. Build to both where both apply.
What is the maximum GDPR fine? €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher, for the most serious infringements.
This article states the position under the GDPR and the European Commission’s adequacy decisions as in force on 21 October 2026, the date of publication. It is not legal advice. Amendments proposed under the Digital Omnibus were pending at that date; confirm your position with a qualified adviser.
Sources: Regulation (EU) 2016/679 — GDPR (EUR-Lex) · EDPB — Guidelines 3/2018 on the territorial scope of the GDPR · European Commission — adequacy decisions · White & Case — GDPR under revision: the Digital Omnibus proposal
Working with European clients or customers? ZAWAT builds custom software and handles integration and support with processing records, transfer documentation and rights handling designed in. Book a call.