Oman's Data Protection Law: The Seven Things It Changes Inside Your Systems
Oman’s Personal Data Protection Law has been in force since 2023. Royal Decree 6/2022 promulgated it, Article 4 of the Decree set it running one year after publication, and the Executive Regulation followed in 2024. If your company holds customer records, employee files, CCTV footage or a marketing list, it applies to you. There is no small-business exemption.
Most coverage of this law is written by lawyers, for lawyers, and stops at “you should review your policies.” This is the other half: the seven things it changes inside the software you actually run.
First, the question everyone asks
Does it apply to me if I only serve Omani customers and have no international operations? Yes. The Law governs the processing of personal data of individuals in the Sultanate. Having no foreign customers narrows one obligation — cross-border transfer — and removes none of the others.
Does it apply to employee data? Employee records are personal data. So are job applications, and the CV sitting in a manager’s inbox from eighteen months ago.
The grace period has already ended
This matters more than the commencement date, and it is the part most summaries leave out.
The Executive Regulation, issued under Ministerial Decision 34/2024, came into force on 5 February 2024 and carried a one-year adjustment period. That period ran out on 5 February 2025. Since then there has been no transitional shelter — the position is that the obligations apply and are enforceable, and the Ministry accredits external auditors to assess compliance.
The practical consequence for a business that has not started is that there is no partial credit for being in progress. The artefacts listed further down either exist or they do not, and the first time most companies discover which is when someone external asks.
The penalties are graded, and one band is much heavier than the rest
The Law does not carry a single headline fine. It assigns different bands to different articles:
| Breach of | Fine (OMR) |
|---|---|
| Article 14 | 500 – 2,000 |
| Articles 15, 16, 17, 18, 20, 22 | 1,000 – 5,000 |
| Article 13 | 5,000 – 10,000 |
| Articles 5, 6, 19, 21 | 15,000 – 20,000 |
| Article 23 | 100,000 – 500,000 |
Administrative penalties, capped at OMR 2,000, sit separately under Article 32.
That top band is worth pausing on. Article 23 governs transferring personal data outside the Sultanate, and it is the only breach the Law prices in six figures. Which means the single most expensive mistake available to you under this law is an infrastructure decision — where your database sits, where your backups replicate to, which SaaS vendor’s servers your CRM data lands on. It is not a marketing consent checkbox. It is architecture.
This is also the reason the rules on where company data may be hosted are not a separate topic from data protection. They are the same topic seen from a different authority.
The seven changes
The Law states obligations. What follows is what those obligations mean in a database and a codebase — the engineering translation, which is where compliance either happens or does not.
1. Consent has to be captured, not assumed
Article 10 requires explicit consent, requested in writing, clearly, explicitly and understandably.
In system terms that is not a checkbox. It is a record: what exactly the person agreed to, in what wording, on what date, through which form, and whether they have since withdrawn it. A boolean column called marketing_optin cannot answer any of those questions six months later when someone asks why they are receiving your emails.
What this usually means in practice: a consent table rather than a consent field, storing the version of the text shown, a timestamp, the source, and the withdrawal event. Pre-ticked boxes and consent bundled into terms of service do not survive contact with a requirement for explicit, understandable agreement.
2. You have to know why you hold every category of data
Not why you hold “customer data” — why you hold each field. The phone number, the national ID copy, the date of birth someone collected in 2019 for a reason nobody remembers.
The system change is a data inventory that is maintained rather than produced once for an audit. In practice the durable version of this is documentation that lives next to the schema, so that adding a column forces a decision about its purpose and its retention. A spreadsheet made for an auditor is accurate for one week.
3. You have to be able to produce everything you hold about one person
A subject access request is a query. If answering one means an engineer writing bespoke SQL across six tables, two legacy systems and an email archive, you do not have a compliance process — you have a heroic effort that will not be repeated consistently.
Build it as a function, not a favour. One input: an identifier. One output: a complete, structured record of everything held, from every system.
The point at which this becomes painful is the point at which you learn how many places customer data actually lives in your business. That discovery is usually more valuable than the request that prompted it.
4. Portability means a machine-readable export
Producing a PDF for a human to read is not the same as producing data another organisation can import. Design the export as structured data from the start; the human-readable version is a rendering of it.
5. Deletion has to be real, and retention has to have a rule
Every category of data needs an answer to “how long, and then what.” And the deletion has to actually delete — including from backups, from the reporting database nobody remembers is a copy, from the analytics tool, and from the CSV a sales manager exported to their laptop in March.
The last one is not solvable with code, which is why the practical control is upstream: reduce the number of places data can be copied to. Every integration that pushes personal data into another system is a place you will later have to delete from. This is the same discipline as deciding which system owns which fact — done for a different reason, with the same answer.
6. You have to be able to detect a breach in time to report one
The deadline is the reason this section exists. Under the Executive Regulation the controller must notify the competent department of the Ministry within 72 hours of becoming aware of a breach that threatens the rights of data subjects, and must notify the affected individuals within the same period where the breach causes severe damage or high risk.
Read that as an engineering requirement rather than a legal one. Seventy-two hours from awareness means you will be writing a notification while the investigation is still open — so the question is not whether you can write it, but whether your systems can tell you what to put in it. A notification obligation you cannot meet is worse than none, because it converts a security incident into a compliance failure as well.
Detection is unglamorous and mostly consists of things you either have or do not: access logging that records who read what and when, alerting on unusual volumes of record access, and a retention period on those logs long enough to investigate. If nobody would notice an employee exporting the entire customer table on a Thursday afternoon, that is the gap. The controls that close it are the same ones in the security baseline for Omani businesses, which is why the two obligations should be planned together rather than by two different people.
7. Your processors are your problem
Every third party that touches personal data on your behalf — the hosting provider, the email platform, the analytics tool, the outsourced call centre, the freelancer with a database login — is part of your compliance position.
Maintain a register: who, what data, on what legal basis, under what contract, hosted where. The “hosted where” column is the one that connects back to Article 23, and it is the one most likely to be blank.
Sensitive personal data is a separate regime
The category that catches companies out is sensitive personal data — the special categories such as health, genetic and biometric data, ethnic origin, religious or philosophical belief, and criminal record.
Two things change when you hold it.
Processing it is subject to authorisation from the Ministry, and the application requires you to set out the precautionary measures you have adopted in the event of a personal data breach. In other words, you are asked to describe your security position before an incident, in writing, to a regulator.
The threshold for holding it is higher than people assume. A mid-sized business that believes it holds no sensitive data will often find it does: medical certificates in HR files, insurance claims, biometric attendance systems, a fingerprint or face-recognition door reader, disability information collected for facilities. None of those feels like a health record; all of them may be treated as one.
The practical instruction is short. Before assuming this section does not apply to you, list the systems that hold anything from that paragraph, and take the list — not the assumption — to a qualified adviser.
Do I need a Data Protection Officer?
Article 20 requires the controller to designate a data protection officer, subject to the conditions set out in the Executive Regulation. Whether your specific business meets those conditions is exactly the question to put to a qualified adviser rather than to an article.
What is worth saying regardless: in a mid-sized business this role is usually assigned to someone who already has a full-time job, and it works only if the assignment comes with authority to stop things. A DPO who can be overruled by whoever wants to ship the integration is a title, not a control.
What an accredited auditor will ask for
MTCIT accredits external auditors to assess private-sector compliance with the Law and its Executive Regulation. Regardless of the specific checklist, the artefacts that make an assessment go well are consistent, and none of them can be produced quickly:
- The data inventory, with purpose and retention per category
- The consent records, showing wording and dates
- The processor register, with locations
- Evidence that a subject access request has been fulfilled end to end
- Access logs, and evidence that someone reads them
- The record of what happens when a breach is suspected
If you want to know how you would score today, try to produce those six things this week. The gaps will be obvious within a day.
Where to start
Start with the register of processors and the question of where each one stores data. It is the fastest to compile, it is usually the most alarming, and it maps directly to the only obligation in this Law priced at half a million riyals.
After that, the inventory. After that, consent. The subject-access machinery comes last, because building it before you know where the data lives is building a query against a map you do not have.
Frequently asked questions
When did Oman’s PDPL come into force? Royal Decree 6/2022 promulgated the Law, and Article 4 of the Decree provided that it applies one year after publication. Publication was 13 February 2022, so the Law has been in force since early 2023. The Executive Regulation followed in 2024.
What is the maximum fine? The heaviest band in the Law is OMR 100,000 to 500,000, attaching to Article 23, which concerns transferring personal data outside the Sultanate. Other bands range from OMR 500 to OMR 20,000, and administrative penalties are capped at OMR 2,000 under Article 32.
Does PDPL apply to a company with no foreign customers? Yes. It concerns personal data of individuals in Oman. Having no international operations affects the cross-border transfer obligation only.
Do I need to appoint a Data Protection Officer? Article 20 requires the controller to designate one according to the conditions in the Executive Regulation. Whether your business meets those conditions is a question for a qualified adviser.
Can I keep using an international cloud service? Possibly, but this is the decision the Law prices most heavily, and it is governed alongside Oman’s cloud and hosting rules. Treat it as an architecture decision requiring advice, not a procurement preference.
Is a privacy policy enough? No. A privacy policy is the visible output of compliance, not compliance itself. What is assessed is whether your systems can do what the policy claims they do.
How long do we have to report a data breach? 72 hours from becoming aware of it, to the competent department of the Ministry, where the breach threatens the rights of data subjects — and to the affected individuals within the same period where it causes severe damage or high risk. The clock starts at awareness, not at the point you finish understanding what happened.
Does a fingerprint attendance system count as sensitive data? Biometric data falls within the special categories, and processing sensitive personal data is subject to authorisation. Attendance and access-control systems are a common place for this to be true without anyone having decided it. Check what your building and HR systems actually store before concluding otherwise.
This article is a summary for business readers as at 21 August 2026 and is not legal advice. The authoritative text is the Law and its Executive Regulation; confirm your position with a qualified adviser.
Sources: Royal Decree 6/2022 — Personal Data Protection Law (full text) · MTCIT — accreditation programme · Clyde & Co — Oman issues Executive Regulations to the PDPL · Pinsent Masons — Oman data protection regulation now in force
Related: ZAWAT’s own privacy policy · we build custom software and business systems with these requirements designed in. Book a call.