OmanPersonal Data Protection Law, data subject rights
Royal Decree No. 6/2022, Art. 11
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must let an individual in Oman revoke their consent, request amendment or blocking of their data, obtain a copy of it, transfer it to another controller, request its erasure (unless national archiving requires otherwise), and must notify them of any breach or infringement of their personal data and the actions taken in response; these rights apply to a voiceprint, faceprint, or other biometric identifier like any other personal data.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Ministry's forms page lists a guideline template on the rights of personal data subjects, published in Arabic only.
- As of
- Open questions
- Does the Article 11 right to transfer one's personal data to another controller, item (d), oblige the controller to send the data to the other controller, or only to give the data subject a portable copy?
What it makes you log
Logging duty
Article 11 gives the data subject six rights, among them the right to be told of a breach and of what was done about it; it requires no log or record and names no check on any record. The controller's duty to prove express consent (Article 10, as replaced) and to keep processing documents (Article 17) sit in articles the row does not cite.
- Kind
- None
- As of
What this law does
Art. 11 gives the data subject six rights: (a) revoke consent to processing, without affecting processing that already took place, (b) request amendment, updating, or blocking of their personal data, (c) obtain a copy of their processed personal data, (d) transfer their personal data to another controller (portability), (e) request erasure, unless processing is necessary for national archiving and documentation, and (f) be notified of any breach or infringement of their personal data and the actions taken in response.
No separate right to object to processing was found in Art. 11; the closest analog is the consent-revocation right at (a), which is narrower since it presupposes the processing rested on consent. Art. 12 separately gives a right to complain to the Ministry. These rights apply to a data subject's personal data generally, biometric identifiers included, since Art. 11 is not limited to any particular data category.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .