OmanPersonal Data Protection Law, comprehensive regime and scope
Royal Decree No. 6/2022, Arts. 3-4, 7, as amended by Royal Decree No. 68/2026
In force since , effective .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator, Registered or designated auditor
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Oman must treat that processing as covered by the Personal Data Protection Law by default, unless it falls within one of Article 3's enumerated exclusions, such as processing in a personal or family setting that is not published.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
Royal Decree 68/2026, in force the day after its publication in the Official Gazette on , replaced Articles 2, 3 and 7 of the Law.
- As of
- Open questions
- Does amended Article 2, which applies the Law to the processing of personal data of natural persons in Oman wherever the processing takes place, reach a foreign service with no place of business in Oman?
- Does the proviso in amended Article 3, item (e), that the personal or family exclusion does not cover data that has been published, take a person's personal or family processing outside the exclusion once the data is posted to an online account?
What it makes you log
Logging duty
Articles 3, 4 and 7, as replaced by Royal Decree No. 68/2026, set the Law's exclusions and the Ministry's powers and impose no log or record duty on a controller or processor. Article 7 lets the Ministry verify compliance and accredit the external auditors who assess it. Replacement Article 2 applies the Law to the processing of personal data of natural persons whether it takes place inside or outside Oman and states no establishment, targeting or location test, so no territorial hook is recorded. The duty to appoint an external auditor at the Ministry's request (Article 16) and to keep processing documents for the periods the Executive Regulation sets (Article 17) sit in articles the row does not cite.
- Kind
- None
- As of
What this law does
Art. 2, as replaced by Royal Decree No. 68/2026, applies the Law to the processing of personal data of natural persons in Oman, whether the processing takes place inside or outside Oman.
Art. 3, as replaced, excludes six kinds of processing from the Law's scope: national security and the public interest, the statutory functions of state administrative bodies and other public legal persons, protection of the state's economic and financial interests, crime detection or prevention on a formal written request from an investigating authority, processing by an individual in a personal or family setting unless the data is published, and historical, scientific, statistical, literary or economic research and statistics by authorized bodies that cannot be traced to an identifiable person.
Art. 4 sets a general coverage default for anything not excluded: personal data is protected under the Law.
The Ministry of Transport, Communications and Information Technology implements the Law under Art. 7, as replaced: it prepares the controls and procedures for protecting personal data, issues the procedures for processing and for checking that controllers and processors comply, receives and decides complaints, cooperates with foreign data protection bodies, advises and coordinates with state bodies, and accredits the external auditors who assess compliance.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .