Oman expands data protection law to cover overseas processing of personal data

Oman has expanded the reach of its data protection framework, introducing new compliance requirements for domestic and international businesses that process personal data relating to individuals in the Sultanate.

The amendments to the Personal Data Protection Law (PDPL), introduced through Royal Decree No. 68/2026, were published in Official Gazette 1664, came into force on September 7, 2026. They represent the most substantial changes to the framework since the original law was enacted under Royal Decree No. 6/2022.

The revised law strengthens requirements for obtaining consent, regulating automated processing, handling employee information, deleting personal data and sending commercial marketing communications. It also updates the government's supervisory powers and revises penalties for certain violations.

Oman extends data protection obligations beyond its borders

One of the most significant changes is the expansion of the law's territorial scope. Under the amended Article 2, the PDPL applies to the processing of personal data belonging to natural persons in Oman, regardless of whether the processing takes place inside or outside the country.

This means international organisations may be subject to Omani data protection requirements even if they have no physical presence in the Sultanate.

Cloud service providers, e-commerce platforms and multinational employers processing the information of Oman-based employees through overseas systems could fall within the law's scope.

Businesses that previously considered their operations outside the PDPL because their systems or offices were located abroad will need to reassess their compliance obligations.

The amendments also revise key definitions. The definition of a controller is now limited to a legal person that processes personal data itself or entrusts the processing to another party. The definition of health data has been expanded to cover physical, mental and psychological health conditions, as well as healthcare services that reveal an individual's health status.

The law also introduces a definition of automated processing, covering electronic systems that operate independently or with limited human supervision.

Consent requirements and exemptions are revised

The amended Article 10 strengthens the requirements for obtaining consent. Controllers must obtain explicit consent and be able to demonstrate that it was secured, although the provision no longer prescribes a particular written form of evidence.

Consent requests must be clear and understandable, identifying the controller and any processor, explaining the purposes and nature of the processing, and providing contact details for the personal data protection officer, alongside other necessary information.

A new Article 10bis also identifies four circumstances in which personal data may be processed without explicit consent: where processing is required by a legal obligation, where data has been lawfully made publicly available, where it is necessary to protect an individual's vital interests and contact is not possible, or where it is necessary to perform a contract to which the individual is a party, subject to the stated compliance conditions.

The amendments also reduce the number of exemptions under Article 3 from 10 to six. Several provisions previously treated as exemptions have been moved to Article 10bis, distinguishing processing that falls outside the law from processing that remains regulated but may proceed without consent.

Businesses will need to review their consent notices, digital interfaces and records, as well as document the legal grounds for processing where they rely on an exception.

New rules cover employee data and workplace surveillance

The amended law introduces Article 5bis, which provides specific exceptions to restrictions on sensitive data processing involving employees.

Employers may process employee personal data where the activity relates to internal operations, complies with the PDPL and does not involve disclosure to third parties without the employee's written consent.

The provision also permits the use of surveillance devices and cameras to meet security requirements issued by competent authorities. The Minister of Transport, Communications and Information Technology may specify additional permitted circumstances.

For employers, the changes make it important to distinguish employee data from customer data in privacy assessments and to establish controls governing access, retention and onward disclosure.

Organisations should also ensure that workplace monitoring has a clear operational or security rationale and is subject to appropriate internal safeguards.

Automated decisions face greater scrutiny

The revised Article 14 establishes a framework for automated processing, replacing the previous prior-notification provision.

Controllers and processors must implement appropriate measures to protect privacy and confidentiality and ensure that automated processing does not cause harm to the data subject.

The law also gives individuals the right to object to decisions resulting from automated processing. Following an objection, the controller or processor must introduce human involvement in reviewing the decision, in accordance with controls to be established by the regulations.

The provision has implications for organisations using artificial intelligence (AI), profiling, automated eligibility assessments and other systems that make or support decisions about individuals.

Businesses should identify where automated decisions are used, establish procedures for handling objections and ensure that human review is available and operates effectively.

The amended penalty framework also places violations of Articles 13 and 14, including requirements relating to automated processing, within a fine range of OMR 5,000 to OMR 10,000. Violations of Article 10's consent requirements carry fines ranging from OMR 500 to OMR 2,000.

Data deletion and commercial marketing requirements tightened

The amended Article 15 requires controllers and processors to erase personal data immediately once the purpose for processing has ended.

Retention remains permissible where an ongoing dispute exists between the organisation and the data subject, or where retention is required by law, a judgment, court order or decision.

The change makes it important for organisations to align data retention schedules with processing purposes and document the reasons for retaining information beyond those purposes.

Separately, amended Article 22 requires controllers to obtain explicit consent before transmitting commercial advertising or marketing material.

Businesses will need to review their marketing databases, campaign platforms and third-party outreach arrangements to ensure that consent can be demonstrated before commercial communications are sent.

Ministry oversight shifts towards compliance verification

The amendments also revise Article 7, updating the Ministry of Transport, Communications and Information Technology's supervisory responsibilities.

The Ministry's functions now include issuing processing requirements, verifying controller and processor compliance, receiving complaints, cooperating with foreign authorities and approving external auditors responsible for evaluating compliance.

The previous provision for licensing service providers has been replaced by the approval of external auditors. Several other functions, including maintaining a register of controllers and processors and publishing periodic activity reports, have been removed from the article.