OmanPersonal Data Protection Law, proof of express consent, external audit and processing documents
Royal Decree No. 6/2022, Arts. 10 (as replaced by Royal Decree No. 68/2026), 16, 17
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Registered or designated auditor
- Where the report goes
- Filed with regulator
As of .
What it requires
- Prove the data subject's express consent before processing personal data in Oman, keep documents of your processing operations for the periods and under the procedures the Executive Regulation sets, and appoint an external auditor when the Ministry asks.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 17 requires the controller and processor to keep documents of processing operations for the periods and under the procedures the Executive Regulation sets, and replacement Article 10 makes the controller prove the data subject's express consent, which needs a consent record. The Law states no period itself. The Executive Regulation (Ministerial Decision 34/2024) Article 27 asks only that the reason for keeping the documents be specific and lawful and that the period fit the purpose of the processing, so no figure is coded. The same Regulation requires a register of processing activities (Article 28) and has a breach documented in it and kept for the period the competent department sets (Article 33); neither sits in an article this row cites. Article 16 has the Ministry require an external auditor, who is accredited under replacement Article 7, and the controller gives the Ministry a copy of the auditor's report; the Law gives the Ministry no express access to the processing documents in the articles cited here. Replacement Article 2 states no establishment, targeting or location test, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- Royal Decree No. 6/2022, Art. 17; Art. 10 (as replaced); Art. 16
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Article 10, as replaced by Royal Decree No. 68/2026, requires the controller to prove the data subject's express consent to the processing of the data subject's personal data. Article 16 requires the controller and processor, at the Ministry's request, to appoint an external auditor to verify that the processing was carried out under the Law, and to give the Ministry a copy of the auditor's report.
Article 17 requires the controller and processor to keep documents of processing operations for the periods and under the procedures the Executive Regulation sets.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.