OmanPersonal Data Protection Law, cross-border transfer
Royal Decree No. 6/2022, Art. 23
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Oman outside the country must follow the controls and procedures the Executive Regulations set and must not transfer data that has been processed in violation of the Law or whose transfer would cause the data subject harm; the Ministry's guidance adds that the controller must obtain the data subject's consent first, unless the transfer fulfills a treaty obligation of Oman or is carried out in a way that ensures the data subject cannot be identified, and must obtain the Cyber Defence Centre's approval before transferring sensitive personal data abroad.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://mtcit.gov.om/sectors/governance/personal
- Guidance body
- Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models)
- Open questions
- What counts as harm to the data subject under Article 23, which bars a transfer that would harm the data subject, and does the controller or the Ministry decide that before a transfer?
What it makes you log
Logging duty
Article 23 lets a controller transfer personal data outside Oman under the controls and procedures of the Executive Regulation and bars the transfer of data processed in breach of the Law or whose transfer would harm the data subject. It requires no log or record of transfers. The Executive Regulation it refers to is outside the row's cited text.
- Kind
- None
- As of
What this law does
Art. 23 permits a Controller to transfer personal data outside Oman, and to allow its transfer, in accordance with the controls and procedures the Executive Regulations set, without prejudice to the Cyber Defence Centre's own competences, and bars the transfer of personal data that was processed in breach of the Law or whose transfer would harm the data subject. The Law states no adequacy test and no list of approved countries.
The Ministry's guidance on the Law and its Executive Regulations states that, as a rule, the controller must obtain the data subject's consent before transferring personal data abroad, with exceptions where the transfer is required to fulfill an international obligation under a treaty to which Oman is a party or is carried out in a way that ensures the data subject cannot be identified.
The same guidance states that approval from the Cyber Defence Centre is required only where sensitive personal data will be stored or processed outside Oman, and that for non-sensitive data no other authority's approval is required, provided the transfer complies with the safeguards in the Regulations. A violation of Article 23 carries the highest fine tier in the Law (100,000 to 500,000 Rial Omani).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .