From Local Compliance to Global Reach: Oman’s Bold New Data Protection Law

7 min 0 sec October 15, 2026 (Edited)

Written by

Fatma Al Zadjali

Associate

f.alzadjali@tamimi.com View LinkedIn Profile

Michael Vadelka

Associate

m.vadelka@tamimi.com

Oman has significantly amended its Personal Data Protection Law (PDPL) through Royal Decree No. 68/2026 (the Amendments), marking the most substantial update to the country’s privacy framework since the law was enacted by Royal Decree No. 6/2022 (the old PDPL).

The Amendments were published in Official Gazette 1664 on 6 September 2026 and came into force on 7 September 2026. They introduce changes that will be particularly relevant for international businesses processing personal data relating to individuals in Oman. This article examines the key amendments and their practical implications for businesses operating in, or serving customers in, the Sultanate.

Expanded territorial scope

The original Article 2 simply stated that the law applied to “Personal Data being processed”, without specifying territorial reach. The amended Article 2 now expressly provides that the PDPL applies to the processing of personal data of natural persons in the Sultanate of Oman, whether the processing is carried out inside or outside Oman.

This is a significant expansion, bringing Oman closer to the extraterritorial approach of the EU General Data Protection Regulation (GDPR) and comparable modern regimes. International businesses should therefore assume that processing personal data relating to individuals in Oman may trigger PDPL obligations, regardless of where the business is established or where its systems, vendors, or personnel are located.

This means that an organisation with no physical presence in Oman, such as a cloud service provider, an e-commerce platform, or a multinational employer processing the data of Oman-based employees through an overseas HR system, may nonetheless fall within the scope of the PDPL solely because it processes the personal data of individuals located in Oman. Businesses that previously assumed the PDPL was irrelevant because their operations are conducted entirely outside Oman should therefore revisit that assessment.

Revised definitions

The Amendments revise two important definitions and add a new one. ‘Controller’ is narrowed from the original concept of a person determining the objectives and means of processing and carrying out the processing, or entrusting it to others, to “the legal person who carries out the processing himself or entrusts it to the processor”. The express reference to determining the objectives and means has been removed, and the definition is now limited to legal persons.

‘Health data’ is expanded to include personal data relating to the health condition of an individual — whether physical, mental, or psychological, or relating to the provision of health care services to the individual that reveal their health status.

Finally, ‘automated processing’ is defined as processing carried out using an electronic programme or system that operates in an automated and automatic manner, either completely independently without any human involvement, or partially with limited human supervision and involvement. These changes will be relevant to governance structures, vendor allocations, and technology risk assessments.

Restructured exemptions

The original Article 3 contained 10 exemptions from the old PDPL’s scope, covering items such as legal obligations, vital interests, contracts, and publicly available data. The Amendments reduce the Article 3 exemptions to six.

Several of the former exemptions have not disappeared; instead, they have been repositioned as exceptions to the consent requirement under new Article 10bis. This is a more coherent legislative structure because it distinguishes between processing that falls outside the law altogether and processing that remains regulated but may proceed without consent.

The personal and family sphere exemption has also been refined so that it no longer applies where the relevant data “is published”. Businesses should reassess existing compliance analyses that treat these circumstances as blanket exclusions from the PDPL.

Enhanced consent requirements

Article 10 has been substantially revised. The original provision required “express consent” and required the controller to prove written consent. The amended provision requires “explicit consent” and focuses on the controller’s obligation to prove that consent, without prescribing that the proof must be in a particular written form.

The request for consent must be clear, explicit, and understandable and must include details of the controller and any processor, the mechanism for contacting the personal data protection officer, the objectives and nature of the processing, and any other information necessary to satisfy the PDPL’s processing conditions.

In practice, businesses should review consent notices, digital interfaces, records of consent, and withdrawal procedures to ensure that the information presented and the evidence retained are sufficiently specific and auditable.

New exceptions to consent (Article 10bis)

New Article 10bis permits processing without explicit consent in four circumstances:

1. where processing is required by a legal obligation imposed on the controller;
2. where the data is publicly available in a lawful manner;
3. where processing is necessary to protect a vital interest of the data subject and contact is not possible; or
4. where processing is necessary to perform a contract to which the data subject is a party, provided the contract evidences compliance with the PDPL.

These exceptions reflect the former Article 3 items that have been reclassified. The change is important operationally: a business relying on an exception should document the applicable legal basis and retain evidence supporting it, rather than treating the relevant processing as outside the PDPL altogether.

New provisions on employee data and surveillance (Article 5bis)

Article 5bis creates targeted exceptions to the restrictions on sensitive data. A controller may process employee personal data where:

• the processing relates to its internal operations;
• the processing is carried out in accordance with the PDPL; and
• the data is not disclosed to third parties without the data subject’s written consent.

The provision also permits processing through surveillance devices and cameras used to meet security requirements issued by competent entities. The minister of the Ministry of Transport, Communications and Information Technology (Ministry) may specify additional permitted cases. This is a welcome practical clarification for employers.

To ensure ongoing compliance with the PDPL, employers should map employee data flows separately from customer data flows, limit access and onward disclosure, and ensure that workplace monitoring has a clear security or operational rationale and is subject to appropriate internal controls.

Regulation of automated processing

The amended Article 14 replaces the original prior-notification provision with a specific framework for automated processing. Controllers and processors must take appropriate procedures and measures to protect privacy and confidentiality and must not cause harm to the data subject.

Most significantly, a data subject has the right to object to decisions resulting from automated processing, and the controller or processor must introduce a human element when reviewing an objected-to decision, in accordance with the controls to be set by the regulations.

The provision closely resembles the policy direction of Article 22 of the GDPR. Businesses using artificial intelligence, automated eligibility tools, profiling, or other decision systems should identify affected decisions, establish escalation and review procedures, and be able to explain how human oversight operates in practice.

Data erasure and direct marketing

Article 15 now imposes a clear obligation on the controller and processor to erase personal data immediately when the purpose of processing ends. Retention remains permitted where an ongoing dispute exists between the controller or processor and the data subject, or where a law, judgment, court order, or decision requires retention. This creates a more direct obligation to link retention schedules to processing purposes and to document any exception.

Separately, the amended Article 22 requires the controller to obtain the data subject’s explicit consent before transmitting advertising or marketing material of a commercial nature. Businesses should ensure that marketing databases, campaign tools, and third-party outreach providers are configured to demonstrate that consent before commercial communications are sent.

Changes to the penalty framework

The Amendments reconfigure the penalty provisions. Article 25 now applies to violations of Article 10 concerning consent requirements and provides for fines of OMR 500 to OMR 2,000, rather than addressing the former Article 14 notification obligation.

Article 27 now covers violations of both Articles 13 and 14, including controller obligations and automated processing, with fines of OMR 5,000 to OMR 10,000. Bringing automated processing into the higher penalty band signals the legislature’s focus on safeguards, accountability, and potential harm arising from automated decisions.

Revised Ministry oversight functions

Article 7 updates the Ministry’s supervisory role. Its functions now include preparing and adopting controls and procedures, issuing processing requirements, verifying controller and processor compliance, receiving complaints, cooperating with foreign authorities, and approving external auditors entrusted with evaluating compliance.

The former licensing of service providers has been replaced by approval of external auditors. Other functions previously listed in Article 7, including drafting indicative forms, publishing periodic activity reports, and maintaining a controller and processor register, have been removed. The revised framework places greater emphasis on compliance verification and the potential role of independent assurance providers.