🇴🇲
Oman
Personal Data Protection Law (Royal Decree No. 6/2022)
Middle East🔵 Substantial
Compliance Score
50%
7 Addressed
6 Partial
1 None
Authority
Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (MTCIT)
Overview
Oman's Personal Data Protection Law is supplemented by Executive Regulations issued in 2024, with amendments made in 2026. The MTCIT's Personal Data Protection Department administers the framework; check the latest consolidated law before relying on individual obligations.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
AddressedDPO Requirements
PartialChildren's Data
AddressedPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
PartialData Localisation
PartialSignificant Data Fiduciary
NoneGovernment Data
Partial? Frequently Asked Questions
What is the primary data protection law in Oman?+
Oman is governed by the Personal Data Protection Law (Royal Decree No. 6/2022). The law is enforced by the Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (MTCIT). According to our analysis, the country has a Substantial level of data protection framework.
Does Oman require a Data Protection Officer (DPO)?+
Partially. The Personal Data Protection Law (Royal Decree No. 6/2022) may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Oman?+
Partially. While Personal Data Protection Law (Royal Decree No. 6/2022) may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Oman?+
Under the Personal Data Protection Law (Royal Decree No. 6/2022), organizations must notify the Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (MTCIT) and affected individuals without undue delay in the event of a personal data breach.