Oman
ModeratePersonal Data Protection Law (Royal Decree 6/2022)
Authority: Ministry of Transport, Communications and IT | Enforcement: Pending | Enacted: February 2023
Overview
Oman enacted its Personal Data Protection Law in 2022, effective February 2023. It provides comprehensive data protection covering consent, data subject rights, and cross-border transfers. Implementing regulations are being developed.
14-Topic Coverage
Data Protection Authority
Pending EnforcementMinistry of Transport, Communications and IT designated. Dedicated authority structure developing.
Consent Requirements
Fully AddressedConsent required for processing. Must be explicit for sensitive data.
Data Subject Rights
Fully AddressedRights to access, rectification, erasure, restriction, and portability.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with appropriate safeguards.
Breach Notification
Fully AddressedMust notify authority and affected individuals of data breaches.
DPO Requirements
Partially AddressedRequired for certain categories of processors.
Children's Data
Partially AddressedEnhanced protections for children's data. Age threshold to be defined.
Penalties & Enforcement
Fully AddressedFines from OMR 1,000 to OMR 500,000. Criminal penalties for serious violations.
Sector-Specific Rules
Partially AddressedCBO financial rules, health data provisions in development.
Cookie/Tracking
Partially AddressedGeneral consent requirements apply.
AI & Automated Decisions
Not AddressedNo specific provisions on automated decisions.
Data Localisation
Partially AddressedGovernment data and certain sectors may require local storage.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedLaw applies to government with exemptions for national security and defence.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Oman's regulations.
Book a Consultation