Processes personal data, in Oman

Royal Decree No. 6/2022, Arts. 3-4, 7, as amended by Royal Decree No. 68/2026 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Oman must treat that processing as covered by the Personal Data Protection Law by default, unless it falls within one of Article 3's enumerated exclusions, such as processing in a personal or family setting that is not published.

Royal Decree No. 6/2022, Art. 11 · Read the law's page

• An app must let an individual in Oman revoke their consent, request amendment or blocking of their data, obtain a copy of it, transfer it to another controller, request its erasure (unless national archiving requires otherwise), and must notify them of any breach or infringement of their personal data and the actions taken in response; these rights apply to a voiceprint, faceprint, or other biometric identifier like any other personal data.

Royal Decree No. 6/2022, Art. 19, breach notification provision · Read the law's page

• An app that suffers a breach leading to the destruction, alteration, disclosure, access, or illegal processing of an individual's personal data in Oman must notify the Ministry and the affected Data Subject, following the procedure the Executive Regulations set; the Ministry's guidance puts the notice to the Ministry at 72 hours from awareness of a breach that threatens data subjects' rights, and the notice to the Data Subject at 72 hours where the breach poses serious harm or high risk.

Royal Decree No. 6/2022, Art. 23 · Read the law's page

• An app transferring the personal data of an individual in Oman outside the country must follow the controls and procedures the Executive Regulations set and must not transfer data that has been processed in violation of the Law or whose transfer would cause the data subject harm; the Ministry's guidance adds that the controller must obtain the data subject's consent first, unless the transfer fulfills a treaty obligation of Oman or is carried out in a way that ensures the data subject cannot be identified, and must obtain the Cyber Defence Centre's approval before transferring sensitive personal data abroad.

Royal Decree No. 6/2022, Art. 8, penalties provisions, as amended by Royal Decree No. 68/2026 · Read the law's page

• An app processing the personal data of an individual in Oman must comply with a Ministry warning, an order to rectify or erase personal data, or a temporary or permanent suspension of processing or of cross-border transfer issued for a violation of the Law.

Royal Decree No. 6/2022, Arts. 1, 5, 5 bis, as amended by Royal Decree No. 68/2026 · Read the law's page

• An app must obtain a Ministry permit before processing biometric data, including a faceprint or voiceprint, about an individual in Oman; the Data Subject's consent alone is not a sufficient basis, and the permit's own conditions sit in the Executive Regulations. Narrow exceptions apply under Article 5 bis, including processing of the controller's own staff data and processing through security cameras.

Royal Decree No. 6/2022, Arts. 10 (as replaced by Royal Decree No. 68/2026), 16, 17 · Read the law's page

• Prove the data subject's express consent before processing personal data in Oman, keep documents of your processing operations for the periods and under the procedures the Executive Regulation sets, and appoint an external auditor when the Ministry asks.