Oman Amended Its Data Protection Law in September 2026: What Royal Decree 68/2026 Changes for Your Business
Oman amended its Personal Data Protection Law on 3 September 2026. Royal Decree 68/2026 was published in Official Gazette 1664 on 6 September and has applied since 7 September 2026, with no transition period. It rewrites nine articles, adds two new ones and introduces a definition of automated processing.
For a private business, four changes matter most. Consent became a request with required contents, and you must be able to prove it. Four situations now need no consent at all. People can object to automated decisions and have a human review them. And personal data must be erased once its purpose ends. Separately, the compliance grace period under the Executive Regulation has already expired: it ended on 5 February 2026.
This article covers what changed. For the full set of system obligations the Law places on you, start with the seven things the PDPL changes inside your systems, and read this as the update to it.
The short answer
| Article | Before September 2026 | Since 7 September 2026 | What it means for you |
|---|---|---|---|
| 2 — scope | “Personal data that is processed” | Personal data of natural persons in Oman, processed inside or outside Oman | Processing abroad by you or your vendors is clearly inside the Law |
| 3 — exemptions | Ten exemptions, including contracts and legal obligations | Six exemptions; contracts and legal obligations removed | Contract and payroll processing is now fully inside the Law |
| 10 — consent | Explicit consent; prove written consent | Explicit consent you must prove, requested with four required elements | Your consent screens need rewriting and versioning |
| 10bis — new | — | Four cases where consent is not needed | Contracts should carry a data protection clause |
| 14 — automated processing | Pre-processing notice duties | Safeguards, a right to object, and human review | Any automated decision needs an objection path |
| 15 — erasure | Follow the Ministry’s controls | Erase immediately when the purpose ends | “Keep it just in case” has no legal basis |
| 22 — marketing | Written consent | Explicit consent | Re-check your marketing lists |
| 5bis — new | — | Employee data and security cameras exempt from the permit, within limits | Sensitive HR data may no longer need a permit |
First, the dates that frame everything
Four dates tell you where you stand, and summaries often merge two of them.
The Law was promulgated by Royal Decree 6/2022, published on 13 February 2022, and applied one year after publication, in February 2023. The Executive Regulation was issued by Ministerial Decision 34/2024 and came into force on 5 February 2024. Its original adjustment period was one year.
That period was then extended. Ministerial Decision 6/2025, published in Official Gazette 1580 on 19 January 2025, replaced it with two years from the Regulation’s entry into force. The grace period therefore ended on 5 February 2026, not in 2025 as some earlier guidance states.
The amendments in Royal Decree 68/2026 came into force on 7 September 2026, the day after publication. They carry no adjustment period of their own. What they require is already required.
1. Scope now follows the person, not the server
The original Article 2 said only that the Law applies to personal data that is processed. The new text says it applies to the processing of personal data of natural persons in the Sultanate, whether the processing is carried out inside or outside Oman.
That settles a question many businesses had left open. If your CRM runs on a foreign platform, your call centre sits in another country, or a group company abroad handles your customers’ records, Omani law follows that data. Moving the processing offshore does not move it out of the Law.
It does not replace the transfer rules. Sending personal data abroad is still governed by Article 23 and the Executive Regulation, and it still carries the heaviest fine in the Law. The new Article 2 simply confirms that the data remains under Omani protection after it leaves. Hosting decisions are covered in where your company’s data is allowed to live.
2. Four exemptions became consent exceptions — and that pulls them into the Law
This is the change most likely to be missed, because it reads like a tidy-up.
The original Article 3 listed situations in which the Law did not apply at all. Among them were processing to meet a legal obligation, to protect a vital interest, to perform a contract with the data subject, and processing of publicly available data. Taken literally, a payroll system run under employment contracts sat largely outside the Law.
The new Article 3 drops those four. What remains exempt is narrower: national security or the public interest, state bodies exercising their legal competences, the state’s economic and financial interests, crime detection on a formal written request, purely personal or family use unless published, and authorised research that identifies no one.
The four removed situations now appear in a new Article 10bis — as cases where you need no consent. Everything else in the Law still applies to them: security, breach notification, erasure, records and transfer rules. Processing you may have treated as out of scope is now in scope, minus the consent step.
3. Consent is now a request with required contents
The new Article 10 keeps the core rule. You may not process personal data, or change the purpose of processing, without the data subject’s explicit consent, and only within transparency, honesty and respect for human dignity. The controller must prove that consent.
What is new is the request itself. It must be written clearly, explicitly and understandably, and it must include:
- the details of the controller and of the processor, if there is one;
- the mechanism for contacting the personal data protection officer;
- the objectives and nature of the processing;
- any other information needed to meet the Law’s conditions for processing.
The original Law put similar information into a separate pre-processing notice under the old Article 14. That article now deals with automated processing, so the notice content effectively lives in the consent request. A breach of Article 10 carries a fine of OMR 500 to 2,000 under the new Article 25.
In system terms this is precise work. A consent screen must name your processors and your DPO contact route. You must also store which version of the wording each person saw. Under the Executive Regulation, consent may be given in writing, electronically or by another means the controller sets, by a person with full legal capacity, clearly and without coercion. Proving it later is your burden, so the record matters as much as the screen.
4. Four situations where you no longer need consent
Article 10bis permits processing without explicit consent in four cases:
- A legal obligation imposed by a law, judgment, order or court decision — tax records and statutory employee filings, for example.
- Data available to the public, provided the processing does not contradict the Law. Publicly visible is not the same as freely reusable for any purpose.
- A vital interest of the data subject when it is not possible to contact them.
- Performing a contract to which the data subject is a party, provided the contract states that the processing is carried out in accordance with the Law.
The last condition is the practical one. If you want to rely on the contract route for customers and employees, your contracts need data protection language. Customer terms, employment contracts and supplier agreements written before September 2026 rarely have it. Adding a short clause is cheaper than collecting consent from every customer.
5. Automated decisions: a right to object and a human in the loop
The new Article 14 is the closest thing Oman has to a binding rule on artificial intelligence. The amendment also adds a definition. Automated processing is processing by an electronic programme or system that runs automatically, either with no human involvement or with limited human supervision.
Three obligations follow:
- Controllers and processors using automated processing must take appropriate measures to protect privacy and confidentiality and to avoid harming the data subject.
- The data subject has the right to object to decisions resulting from automated processing, “in all cases”.
- When someone objects, the controller or processor must introduce the human element in reviewing the decision, under controls the Executive Regulation is to set. As of publication we have not found those controls issued.
The Law does not define “decision”, so the cautious reading is a broad one. A credit limit set by a model, an applicant filtered out by screening software, an order cancelled by a fraud rule, or a refund refused by a chatbot all qualify.
The fine for breaching Article 14 is OMR 5,000 to 10,000 under the new Article 27, the same band as failing to put Article 13’s controls in place.
In practice you need three things: a way for people to object, a queue where a person reviews the objection, and logs showing what the system decided and why. If your chatbot can refuse anything, read how a custom business chatbot is actually built with this article in mind.
6. Erasure is now the default
The new Article 15 requires controllers and processors to erase personal data immediately once the purpose of processing ends. Only two exceptions allow it to be kept: an existing dispute with the data subject, or a legal obligation imposed by a law, judgment, order or court decision.
“We might need it later” is not on that list. Nor is “the analytics team likes historical data.” Every retention period in your systems now needs to point at either an open dispute or a specific legal obligation, such as a tax retention rule. A breach of Article 15 falls in the OMR 1,000 to 5,000 band under Article 26.
This is an engineering change more than a policy change. Deletion has to reach backups, reporting copies and exports, which is why it belongs in the design rather than in a yearly clean-up. Privacy by design in custom software covers how to build it in.
7. Marketing needs explicit consent first
Article 22 previously required written consent before sending commercial advertising or marketing. It now requires explicit consent, obtained before sending, in the manner the Regulation sets. The Executive Regulation already requires you to tell people which channel you will use, give them a way to stop, and stop immediately and free of charge when asked.
If your marketing list was built from purchase records, event sign-ups or a pre-ticked box, check it. A breach falls in the OMR 1,000 to 5,000 band.
8. Employee data and security cameras: a limited permit exemption
Article 5 still prohibits processing sensitive categories — genetic, biometric and health data, among others — without a permit from the Ministry. The new Article 5bis creates exceptions.
Employee data may be processed without a permit when three conditions hold. The processing must sit within the organisation of the controller’s internal work and comply with the Law. The data must not be disclosed to third parties without the employee’s written consent. Surveillance devices and cameras used to meet security requirements issued by competent authorities are also exempt. The Minister may add further cases by decision.
This matters for anyone running fingerprint attendance, keeping medical certificates in HR files, or operating CCTV. Those activities may no longer need a permit. Two cautions apply. The exemption covers the permit only, not the rest of the Law. And whether sharing HR data with an outsourced payroll provider or an insurer counts as disclosure to a third party is a question for a qualified adviser.
Two definitions also changed
Health data now expressly includes data relating to the provision of health care services that reveals a person’s health status. Appointment histories and insurance claims are therefore harder to treat as ordinary data.
The controller is now defined as the legal person who carries out the processing itself or entrusts it to a processor. How that applies to a sole proprietor is not obvious from the text, and it is another point to confirm with an adviser.
The penalty table, as it stands now
| Breach of | Fine (OMR) | Penalty article |
|---|---|---|
| Article 10 (consent) | 500 – 2,000 | 25 |
| Articles 15, 16, 17, 18, 20, 22 (erasure, auditor, records, cooperation, DPO, marketing) | 1,000 – 5,000 | 26 |
| Articles 13 and 14 (controls, automated processing) | 5,000 – 10,000 | 27 |
| Articles 5, 6, 19, 21 (sensitive data, children, breach notification, confidentiality) | 15,000 – 20,000 | 28 |
| Article 23 (transfer outside Oman) | 100,000 – 500,000 | 29 |
A legal person faces a fine of OMR 5,000 to 100,000 where an offence is committed in its name or for its account by its management, or through their consent, concealment or gross negligence (Article 30). Administrative fines of up to OMR 2,000 per violation sit alongside these (Article 32 of the Law and Article 44 of the Regulation).
What has not changed
The transfer rule and its six-figure band are untouched. So is breach notification: the competent department within 72 hours of awareness where the breach threatens data subjects’ rights, and the affected people within 72 hours where it may cause serious harm or high risk. The DPO duty, the record of processing activities and external audits on the Ministry’s request also stand as before.
What to do this month
- Rewrite your consent requests to include the four required elements, and version them so you can prove what each person saw.
- Add data protection language to your contracts — customer terms, employment contracts, supplier agreements — so the contract route in Article 10bis is available to you.
- List every automated decision your systems make about people, and build an objection path with human review for each.
- Replace open-ended retention with purpose-based erasure, and keep a short register of the legal obligations that justify longer retention.
- Re-check marketing lists for explicit consent and a working opt-out.
- Re-test HR and CCTV processing against the conditions in Article 5bis before dropping any permit application.
Frequently asked questions
When did the PDPL amendments come into force? On 7 September 2026. Royal Decree 68/2026 was issued on 3 September 2026, published in Official Gazette 1664 on 6 September, and took effect the day after publication. There is no transition period.
Did the grace period end in February 2025 or February 2026? February 2026. The Executive Regulation originally allowed one year from 5 February 2024. Ministerial Decision 6/2025 extended that to two years, so the adjustment period ended on 5 February 2026.
Can I process customer data without consent now? Only in the four cases in Article 10bis: a legal obligation, publicly available data, a vital interest when the person cannot be reached, or a contract with the data subject that states the processing complies with the Law. Outside those, explicit consent remains the rule.
Does the new Article 14 apply to my chatbot? If the chatbot makes or applies decisions about people — refusing a refund, rejecting an application, cancelling a booking — the cautious answer is yes. People must be able to object, and a person must review the decision they object to.
Do I still need a permit for fingerprint attendance? Possibly not. Article 5bis exempts processing of employees’ data within the organisation of internal work, provided it complies with the Law and is not disclosed to third parties without written consent. Confirm your specific setup with an adviser before dropping an application.
Does the Law now apply to companies outside Oman? It applies to processing of personal data of natural persons in Oman, whether the processing happens inside or outside the country. How the Ministry will enforce it against a company with no presence in Oman is a separate question.
This article states the position under the Personal Data Protection Law as amended by Royal Decree 68/2026, and its Executive Regulation, as in force on 21 October 2026, the date of publication. It is not legal advice. The Executive Regulation has not yet been updated for the amendments; confirm your position with a qualified adviser.
Sources: Royal Decree 68/2026 amending the Personal Data Protection Law (English translation) · Royal Decree 68/2026 (Arabic text) · MTCIT — Royal Decree 68/2026 · Royal Decree 6/2022 — Personal Data Protection Law · Ministerial Decision 6/2025 extending the adjustment period · Ministerial Decision 34/2024 — Executive Regulation
Need your systems updated for the amendments? ZAWAT builds custom software and business systems with consent records, objection paths and erasure designed in. Book a call.