Personal Data Protection Law, cross-border transfer

Royal Decree No. 6/2022, Art. 23

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 13 February 2023.

A cross border transfer rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app transferring the personal data of an individual in Oman outside the country must follow the controls and procedures the Executive Regulations set, whose substantive text is not confirmed at primary source; a violation of this provision carries by far the highest penalty tier in Oman's Personal Data Protection Law.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 23 permits a Controller to transfer personal data outside Oman "in accordance with the controls and procedures determined by the regulation," without prejudice to the Cyber Defence Centre's own competences. The Royal Decree itself states no adequacy test, no whitelist, and no enumerated conditions of its own; the entire substantive transfer regime is deferred to the Executive Regulations (Ministerial Decision 34/2024), not read at primary source.

What the Decree does confirm is that a violation of Art. 23 carries by far the highest penalty tier in the whole Law (100,000 to 500,000 Rial Omani), a strong signal of seriousness even though the substantive rule is deferred. This instrument alone does not establish Oman's jurisdiction-level cross-border posture; the moderate restriction recorded at jurisdiction level rests on the Bahrain and UAE comparators in this batch, not on Oman's own Executive Regulations text.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

Read the law

official consolidated Royal Decree text, decree.om

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app