Personal Data Protection Law — transfer of personal data outside Oman

Oman stacks a consent requirement on top of an adequacy requirement, which makes it stricter in practice than most regimes here. Transferring personal data outside Oman requires the EXPRESS CONSENT of the data subject unless the data is anonymised, AND the external processing party must maintain a level of protection not less than the PDPL's own, AND the transfer must not prejudice national security or higher national interests. Consent-based transfer at scale is fragile — consent can be withdrawn — so a business routing Omani personal data to an overseas parent or cloud region should treat this as a design constraint rather than a paperwork step. With the transition period closed on February 5, 2026, the regime is now fully enforceable. Marked 'check': the operative texts are Arabic-language originals and the interaction between the consent limb and the adequacy limb was triangulated across independent sources.