Electronic Signatures and Records in Oman: What the 2025 Electronic Transactions Law Means for Your Systems

Yes — in Oman an electronic document counts as a written document with legal effect, and electronic signatures are admissible as evidence. The current rules are in the Electronic Transactions Law issued by Royal Decree 39/2025. It was published in Official Gazette 1591 on 13 April 2025, took effect the next day, and repealed the 2008 law.

The law recognises three levels of electronic signature: simple, advanced and certified. It also allows contracts to be formed through automated systems such as a website checkout or a chatbot.

For a business, the practical question is not whether paperless approval and contracting are allowed. It is whether your systems keep electronic records in a way that will still count if a document is ever disputed. And it is whether the signature you use matches what is at stake.

The short answer

• Electronic documents have legal effect as written documents when the law’s conditions for creating and approving them are met (Article 8).
• Electronic records remain valid when kept unaltered, accessible, and with originator, recipient and time identifiable (Article 9).
• Simple signatures — a typed name, a click, a PIN — are admissible, and their weight depends on how reliable the process was (Articles 11 and 16).
• Advanced and certified signatures carry stronger evidential weight when they meet three technical conditions (Article 17).
• Contracts can be concluded by automated agents, including between a system and a person who knows, or should know, they are dealing with one (Article 19).
• Providing trust services, such as certified signatures or electronic seals, to others needs a licence (Article 25).

What changed from the 2008 law

The 2025 law is shorter — 37 articles in seven chapters. Commentators describe it as an update rather than a rebuild of the 2008 framework. Five changes matter for businesses:

1. Trust services replace “certification services”. Article 24 lists them: issuing electronic certification certificates, certified electronic signatures, electronic seals, electronic identity verification, electronic delivery services, and others the Ministry designates.
2. Oversight sits with the Ministry of Transport, Communications and Information Technology, through a Trust Services Management Committee that licenses providers and approves foreign ones.
3. The 2008 list of excluded matters is gone. The old law expressly excluded personal status matters, court procedures and documents requiring notarisation. The 2025 text has no equivalent list. That does not override another law that prescribes a specific form for a specific document, so check the law that governs the document in question.
4. Automated agents are recognised for attributing documents and forming contracts.
5. Penalties rose sharply. The heaviest — for providing trust services without a licence or giving misleading information to obtain one — is three to five years’ imprisonment and/or a fine of OMR 20,000 to 50,000. Legal persons face double the maximum fine.

The Minister is to issue an executive regulation. We did not find it issued at the time of writing. Several details, including the conditions for automated agents, are left to it.

When an electronic document counts

Article 8 makes an electronic document a written document with legal effect, provided the conditions in the law, its regulation and implementing decisions are met. Article 10 treats it as an original where the method used displays its content clearly and can be relied on technically to verify that the information has not changed.

Article 11 then sets out how courts weigh an electronic document as evidence. It looks at four things:

• the reliability of how the document was created, stored, presented or sent;
• the reliability of how its integrity was preserved;
• the reliability of its source, if known;
• the reliability of how the originator’s identity was verified, where relevant.

Read those four as a design brief. A purchase approval in your system will hold up better if it was captured through an authenticated session and stored with a tamper-evident trail. A forwarded screenshot of a WhatsApp message will hold up worse. The law does not demand a particular technology. It rewards a process you can explain.

Keeping electronic records so they still count later

Article 9 sets three conditions for keeping an electronic document validly:

1. It is kept in the form in which it was created, sent or received — or encrypted, or in any form that ensures its content has not been changed.
2. It remains accessible and usable for later reference at any time.
3. It is kept in a way that identifies the originator, the recipient, and the date and time of creation, sending or receipt.

The article adds that this is without prejudice to other laws on keeping records, such as tax retention periods.

In system terms that means four things:

• Write-once storage for signed or final documents, or hashes that detect any change.
• An audit trail that records who created, approved, sent and received each document, and when.
• Formats that will still open in ten years.
• An export path that carries the metadata with the document.

A shared drive where anyone can overwrite last year’s contract fails the first condition, however carefully people behave.

There is one tension to manage. Since September 2026, Oman’s data protection law requires personal data to be erased when its purpose ends, unless a dispute or a legal obligation requires keeping it. Records you keep for legal reasons should be tied to the specific obligation and period. Oman’s 2026 data protection amendments explain the erasure rule.

The three signature levels, and which one a transaction needs

Level	What it is	Legal effect	Typical use
Simple (Article 16)	A signature in the form of letters, numbers, symbols or signs — a typed name, an “I agree” click, a PIN	Admissible if the Article 11 reliability factors are met; anyone may prove it is reliable	Routine internal approvals, low-value orders, acknowledgements
Advanced (Article 17)	A unique signature that identifies the signer and distinguishes them from others	Admissible when the creation tool is linked to the signer alone and under their control, and changes to the signature and signed data are detectable	Supplier contracts, HR documents, higher-value approvals
Certified (Article 17)	An advanced signature linked to an electronic certification certificate issued by a licensed trust service provider	As above, with the identity anchored by a licensed provider	High-value contracts, documents likely to be contested, regulated transactions

Article 30 adds a rule worth adopting even where it does not strictly bind you. An electronic service provider that relies on trust services must set the security level of the signature according to the nature and importance of the transaction. It must also verify the signer, the certificate and the signature’s validity. If it does not, its liability to third parties remains.

In plain terms: do not use a certified signature for a leave request, and do not use a checkbox for a OMR 200,000 supply contract.

Contracts through your website or chatbot: automated agents

The 2025 law defines an automated electronic agent as a programme, electronic system or other electronic means used to take or respond to an action without a natural person’s intervention. Three articles follow from that.

Article 12 — attribution. A document issued through an automated agent that the originator has set up to work automatically is treated as issued by the originator. Your system’s confirmations, quotes and replies are yours.

Article 18 — offer and acceptance. Offer and acceptance may be expressed electronically, and bind the parties once signed electronically under the law.

Article 19 — contracts with automated agents. A contract may be concluded between pre-programmed automated agents. It may also be concluded between an automated agent and a person who knows, or is presumed to know, that they are dealing with one. The executive regulation is to set conditions for the agent.

The design lesson is that an online checkout or booking chatbot can form binding contracts — in both directions. Make it clear the customer is dealing with an automated system. Show the terms before acceptance. Send an acknowledgement of receipt; Article 13 deals with how acknowledgements work. And log the exchange. If your chatbot can promise refunds or prices, it can bind you to them, which is the subject of when your chatbot gets it wrong.

Trust services are licensed — with an exemption for closed systems

Article 25 prohibits providing any trust service without a licence from the Ministry. There is an exemption for trust services provided inside a closed information-processing system within an organisation and the bodies under its supervision. The system must not deal with any third party, or use or provide trust services for external transactions.

Two practical consequences follow:

• Internal signing is usually fine. An approval workflow in which only your staff sign, for internal purposes, is the kind of closed system the exemption describes.
• Selling signing to others is a regulated activity. If you build a product that issues certified signatures, electronic seals or identity verification for other businesses, you may be providing trust services and need a licence. Get advice before launch. The penalty for unlicensed provision is among the heaviest in the law.

What to build into approval and document systems

1. Authenticate every signer with at least a personal login, and multi-factor authentication for anything above routine value.
2. Record the evidence trail — who, what, when, from where, and which version of the document.
3. Make signed documents tamper-evident with hashing or write-once storage.
4. Choose the signature level per document type, and write the rule down so staff do not improvise.
5. Tell customers when they deal with an automated system, show terms before acceptance, and send acknowledgements.
6. Plan retention per document type, tied to the legal obligation that requires it, and erase what no obligation covers.

Most of this belongs inside the systems that already run approvals, which is why it is usually a business systems question rather than a separate e-signature purchase. Who can see what: access control and audit trails covers the logging side.

---

Frequently asked questions

Are electronic signatures legally valid in Oman? Yes. Under Royal Decree 39/2025 a simple electronic signature is admissible as evidence if the process meets the reliability factors in Article 11. Advanced and certified signatures carry stronger weight when they meet the conditions in Article 17.

Is a contract signed by clicking “I agree” binding in Oman? Offer and acceptance may be expressed electronically and bind the parties once signed electronically under the law. A click is a simple electronic signature, so its strength depends on the reliability of the process. That includes identifying the person, showing them the terms, and recording what they accepted.

What is the difference between an advanced and a certified electronic signature? An advanced signature uniquely identifies the signer and is created with a tool under their sole control, with any later change detectable. A certified signature is an advanced signature linked to an electronic certification certificate issued by a licensed trust service provider.

Can my chatbot conclude contracts with customers? The law permits contracts between an automated agent and a person who knows, or is presumed to know, that they are dealing with one. Documents issued through your automated agent are treated as issued by you. Design the chatbot accordingly, and confirm the executive regulation’s conditions once issued.

Do I need a licence to use electronic signatures in my company? Not to use them. A licence is required to provide trust services. Services inside a closed internal system that deals with no third party are exempt. Selling signing or identity-verification services to other businesses is a different matter.

Did the 2025 law keep the 2008 exclusions for notarised documents? The 2025 text has no list of excluded matters. Where another law prescribes a specific form or procedure for a document, that law still governs, so check the rule for the document concerned.

---

This article states the position under the Electronic Transactions Law issued by Royal Decree 39/2025 as in force on 21 October 2026, the date of publication. It is not legal advice. The law’s executive regulation had not been found issued at that date; confirm your position with a qualified adviser.

Sources: Royal Decree 39/2025 — Electronic Transactions Law (Arabic text) · Decree — New Electronic Transactions Law issued · Al Tamimi — Oman enacts new Electronic Transactions Law · Oman Observer — New law offers legal framework for e-transactions · Royal Decree 69/2008 — the repealed 2008 law (Arabic text)

Moving approvals and contracts off paper? ZAWAT builds business systems and custom software with authenticated signing, tamper-evident records and audit trails designed in. Book a call.