Personal Data Protection Law

Royal Decree 6/2022 replaced the data-protection provisions previously embedded in Oman's Electronic Transactions Law with a standalone regime, in force since February 2023 and given operative detail by the Executive Regulations issued under Ministerial Decision 34/2024, which opened a one-year window for controllers to align. It applies to the processing of personal data in Oman; there is no clearly expressed GDPR-style targeting clause reaching a foreign controller with no Omani footprint, so the trigger below is modeled on established presence only. Notable features: consent is the default basis with limited exceptions, permits from the Ministry of Transport, Communications and Information Technology are required for certain processing (including sensitive data such as genetic, biometric, health, ethnic and religious data), breach notification duties apply, and violations carry both administrative fines and criminal penalties.