OmanPersonal Data Protection Law, biometric and sensitive data prior permit
Royal Decree No. 6/2022, Arts. 1, 5, 5 bis, as amended by Royal Decree No. 68/2026
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app must obtain a Ministry permit before processing biometric data, including a faceprint or voiceprint, about an individual in Oman; the Data Subject's consent alone is not a sufficient basis, and the permit's own conditions sit in the Executive Regulations. Narrow exceptions apply under Article 5 bis, including processing of the controller's own staff data and processing through security cameras.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models) (guidance, recorded ).
Who enforces it
Settledness
Royal Decree 68/2026 added Article 5 bis, which excepts certain processing from the Article 5 permit, including processing of the personal data of those working for the controller.
- As of
- Guidance link
- https://mtcit.gov.om/sectors/governance/personal
- Guidance body
- Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models)
- Open questions
- Does a facial image that has undergone no specific technical processing count as biometric data under the Article 1 definition, so that the Article 5 permit applies to it?
- Does the Article 5 bis exception for processing carried out through surveillance devices and cameras used to meet security requirements remove biometric processing of a camera image from the Article 5 permit duty?
What it makes you log
Logging duty
Articles 1, 5 and 5 bis define biometric data, bar the processing of sensitive categories without a Ministry permit and set exceptions for staff data, surveillance cameras and cases the Minister fixes; none of them requires a log or record. The requirement that a controller prove the data subject's express consent (Article 10, as replaced) and the duty to keep processing documents (Article 17) sit in articles the row does not cite.
- Kind
- None
- As of
What this law does
Art. 1 defines biometric data as personal data resulting from specific technical processing relating to physical, psychological, or behavioral characteristics, such as a facial image or genetic fingerprint data, naming a facial image as a worked example.
Art. 5 prohibits processing genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or security-measures data, except after obtaining a Ministry permit under controls and procedures the Executive Regulations set out.
New Art. 5 bis, added by Royal Decree No. 68/2026, excepts three cases from that rule: the personal data of those working for the controller, where the processing is part of the controller's internal work organization, follows the Law, and discloses nothing to third parties without the data subject's written consent; processing through surveillance devices and cameras used to meet security requirements issued by the competent authorities; and other cases the Minister fixes by decision.
This is a prior-permit model, structurally the same heightened gate found in Bahrain: outside those cases, a service cannot rely on the Data Subject's consent alone to process biometric data in Oman. No modality-specific voice provision exists beyond the general definition, which would still reach a voiceprint as a behavioral characteristic enabling identification.
The Law sets no retention period or destruction duty specific to biometric data, and replacement Article 15 requires the controller and the processor to erase personal data immediately upon the end of the purpose of its processing, save for an existing dispute or a legal obligation.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .