21 October 2026·10 min read·By ZAWAT Team

Hiring a Software Company Without Handing Over Your Data: NDAs, Processing Agreements and Access Rules

When a software company builds, hosts or supports your systems, it usually sees your data. That includes the personal data of your customers and staff, and often your pricing, contracts and plans. Under Oman’s Personal Data Protection Law the vendor is your processor. The Executive Regulation treats a processor as acting on the controller’s behalf, for civil liability and for administrative liability before the Ministry. In practice, its mistakes with your data become your problem.

Three instruments protect you:

a non-disclosure agreement for confidential business information;
a data processing agreement for personal data;
access rules that limit what the vendor’s people can reach in the first place.

This article covers all three. Ownership of the code, acceptance, support and exit are covered in how to choose a software partner in Oman and who owns the software you paid for.

The short answer

The vendor is your processor, and you remain responsible for what it does with personal data.
An NDA protects business information; a processing agreement protects personal data. You usually need both.
Production data should not leave production. Developers work with masked or synthetic data.
Production access is the exception: named accounts, multi-factor authentication, time-limited and logged.
Offshore developers handling personal data means a cross-border transfer under Oman’s law.
At the end, data comes back or is deleted — with confirmation — and access is revoked the same day.

Why the vendor’s handling of your data is your liability

Article 3 of the Executive Regulation allows a controller to contract a processor. It treats the processor, in its dealings with others, as acting on the controller’s behalf for civil liability and administrative liability before the Ministry. The processor keeps its own criminal liability for breaches it commits.

Four consequences follow:

A breach at the vendor is your breach to report. If it threatens data subjects’ rights, you must notify the Ministry’s competent department within 72 hours of becoming aware. Your contract must make the vendor tell you fast enough for that to be possible.
Your records must cover it. The record of processing activities includes who receives personal data and where it goes.
Where the vendor works matters. If its staff or servers are outside Oman and they access personal data, that is a transfer abroad, with consent and assessment requirements and the Law’s heaviest fine band.
Vendor staff are inside the criminal law too. The 2026 Cybercrime Law penalises exceeding authorised access. It applies heavier penalties when the offence is committed in the course of work, and leaving the job does not escape it. That only helps you if the contract and the system define what access was authorised.

Instrument 1: the non-disclosure agreement

An NDA covers what is not personal data but is still valuable: source code, pricing models, supplier terms, business plans, security configurations, and the fact of the project itself. A useful one:

Defines confidential information broadly, including data the vendor sees in your systems and information in any form.
Limits use to the project. The information may be used only to deliver the services, not to build products for others.
Restricts disclosure to named people who need it, bound by equivalent obligations — including subcontractors and freelancers.
Covers AI tools explicitly. No entering your information into external AI tools except approved business tools with suitable terms.
Requires return or destruction at the end, with written confirmation.
Survives the contract for a defined period, and indefinitely for trade secrets.

There is a legal reason to bother beyond the contract claim itself. Oman’s Industrial Property Law protects undisclosed information against disclosure or use contrary to honest commercial practice, including breach of contract and breach of confidence. Part of the definition is that the holder took reasonable steps to keep the information secret. A signed NDA, together with access controls, is evidence of those steps.

Instrument 2: the data processing agreement

Personal data needs more than confidentiality. A data processing agreement sets out how the vendor may handle it. Ten clauses carry the weight:

Instructions only. The vendor processes personal data only on your documented instructions and for the services.
Confidentiality of personnel. Everyone with access is bound to confidentiality.
Security measures, described concretely: access control, encryption, logging, backups, and testing of whether the measures work. Oman’s Regulation expects these of the controller, and a processor must help you meet them.
Sub-processors only with your prior authorisation, listed with their locations, and bound by the same terms.
Location and transfers. Where data is stored and accessed, no transfer abroad without your consent, and the information you need for the transfer assessment the Regulation requires.
Breach notification to you within a short, defined period — well inside your own 72 hours — with the information needed for your notice.
Assistance with data subject requests. The Regulation gives you 45 days to decide on access and similar requests, and some of the data may sit with the vendor.
Assistance with audits, including any external auditor the Ministry asks you to appoint.
Return and deletion at the end, including backups within a stated cycle, with written confirmation.
Records of the processing it carries out for you, available on request.

If you also process personal data of people in the EU, GDPR Article 28 lists similar mandatory terms. A single agreement can be drafted to satisfy both. Does GDPR apply to a company in Oman or the Gulf covers when that matters.

Instrument 3: access rules

Contracts set obligations; access rules limit how much can go wrong. In practice:

No production data in development. Developers build and test with masked or synthetic data. Where a real-data test is unavoidable, it happens in a controlled environment, with access logged and the copy deleted afterwards. Privacy by design in custom software covers masking.
Production access for support only. Named accounts — never a shared “vendor” login — with multi-factor authentication and the narrowest role that does the job. Access is granted for a task and time-limited where possible.
Everything logged. Who accessed what, when, and what they changed or exported. Who can see what covers the design.
No copies on laptops. Exports from production go through an approved, logged route, or not at all.
Your accounts, their access. Repositories, cloud accounts and domains belong to your company, with the vendor given access, not the reverse.
Secrets stay secret. Passwords and keys live in a secrets manager, not in code, chat messages or email.

Offshore development teams

Many vendors use developers in other countries. That is a legitimate way to control cost. But if those developers can see personal data from your systems, the data is transferred outside Oman. The Executive Regulation then requires the data subjects’ explicit consent, unless the data is anonymised. It also requires an assessment of the protection the recipient provides, which the Ministry may ask to see.

The practical answer is architectural. Give offshore teams masked or synthetic data. Keep production support that needs real data with staff in Oman, or under tightly controlled, logged access backed by the transfer work. Ask every bidder where its people sit and what they will be able to see.

AI tools in the vendor’s workflow

Developers increasingly use AI coding assistants and chat tools. Ask vendors to disclose which tools they use. Require business accounts with terms that exclude training on your content, and prohibit pasting your data, credentials or confidential code into consumer tools. The same rules you set for your own staff, described in a policy for staff using AI tools, should bind the people working on your systems.

Due diligence before you sign

Ten questions worth asking every bidder:

Who will have access to our data, and where are they located?
Will any of our personal data be accessed or stored outside Oman?
Which sub-processors do you use — hosting, monitoring, email, AI tools?
How do developers get test data?
How is production access granted, logged and removed?
What is your process and timeline for notifying us of a breach?
Which AI tools do your staff use, and on what terms?
How do you secure laptops and remote access?
How will you return or delete our data at the end, and confirm it?
Can you show us a recent example of your security practices — a policy, an audit, a certification — rather than describe them?

The answers matter less than how readily they come. A vendor that has thought about these will answer in specifics.

At the end of the contract

The end is when control most often slips. On termination or handover:

revoke every vendor account and key the same day;
obtain the return of data and written confirmation of deletion, including backups on their stated cycle;
confirm that repositories and infrastructure are in your accounts;
update your processor register;
keep the NDA’s surviving obligations in a place someone will remember.

Frequently asked questions

Is my software vendor a “processor” under Oman’s data protection law? If it processes personal data on your behalf — building, hosting or supporting systems that hold it — yes. The Executive Regulation treats a processor as acting on the controller’s behalf for civil and administrative liability. The processor keeps its own criminal liability for its breaches.

Do we need both an NDA and a data processing agreement? Usually. An NDA protects confidential business information such as code, pricing and plans. A processing agreement sets how personal data is handled: instructions, security, sub-processors, transfers, breach notice, assistance with requests, and deletion.

Can our vendor use production data for testing? Avoid it. Developers should use masked or synthetic data. Where a real-data test is unavoidable, use a controlled environment, log access and delete the copy afterwards.

Is it a problem if our vendor’s developers are outside Oman? Not if they never see personal data. If they do, it is a transfer abroad, which requires explicit consent or anonymisation and an assessment under the Executive Regulation. Give offshore teams masked data and keep real-data access tightly controlled.

Who notifies the regulator if our vendor has a breach? You do, as controller. The notice to the Ministry is due within 72 hours of becoming aware where the breach threatens data subjects’ rights, so your contract must oblige the vendor to tell you promptly.

What should happen to our data when the contract ends? It should be returned in a usable format and then deleted by the vendor, including from backups within a stated cycle. The vendor should confirm this in writing, and you should revoke all its access the same day.

This article states the position under the Personal Data Protection Law as amended by Royal Decree 68/2026, its Executive Regulation, the Industrial Property Law and the Law on Combating Information Technology Crimes, as in force on 21 October 2026, the date of publication. It is not legal advice. Have contracts reviewed by a qualified adviser before signing.

Sources: Ministerial Decision 34/2024 — Executive Regulation of the PDPL (Arabic text) · Royal Decree 68/2026 amending the Personal Data Protection Law · Royal Decree 67/2008 — Industrial Property Law (Arabic text) · Royal Decree 61/2026 — Law on Combating Information Technology Crimes (Arabic text) · GDPR Article 28 (EUR-Lex)

Hiring a software company and want your data protected from day one? ZAWAT builds custom software and provides integration and support, and we are glad to work under your NDA and processing agreement. Book a call.

Share:X in ✆