OmanPersonal Data Protection Law, reach over scraped public personal data
In force since .
A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- A scraper collecting the personal data of an individual in Oman from a public page may rely on Article 10 bis, item (b), only to skip the express consent that Article 10 otherwise requires; the Law still applies to that processing, and the data must be public in a manner that does not contravene the Law. A biometric identifier such as a faceprint or voiceprint derived from publicly posted photographs, video, or audio requires a Ministry permit under Art. 5 regardless of the recording's public availability.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 10 bis, added by the amending decree, lets a controller process personal data without the data subject's explicit consent where the data are available to the public and the processing does not breach the Law. The clause states no duty to create, keep or produce a record. Article 10 of the Law, which the row does not cite, requires the controller to prove the explicit consent it relies on, and Article 15 requires deletion of the data once the purpose ends, with exceptions for a pending dispute or a legal duty to keep it. The gazette issue read carries the amending decree, not the text of Articles 2 and 3 of the Law, so no territorial hook is recorded for this row.
- Kind
- None
- As of
What this law does
Royal Decree No. 68/2026 replaced Article 3, which no longer lists lawfully publicly available data among the processing excluded from the Personal Data Protection Law (the former Art. 3(j)).
Replacement Article 2 applies the Law to the processing of personal data of natural persons in Oman, inside or outside Oman, and replacement Article 3 excludes only a short list of processing: national security and the public interest, the statutory functions of state bodies, protection of the state's economic and financial interests, crime detection or prevention on a formal written request, personal or family processing unless the data is published, and de-identified research and statistics.
Public availability now matters only as an exception to the express-consent rule in Article 10: new Article 10 bis, item (b), lets a controller process personal data without that consent where the data is available to the public and the processing does not contravene the Law.
A scraper collecting personal data of an individual in Oman from a public page therefore remains subject to the Law's other duties (security, purpose limitation, cross-border transfer, breach notification), and a biometric identifier such as a faceprint or voiceprint derived from publicly posted photographs, video, or audio still needs a Ministry permit under Art. 5, which Article 10 bis does not lift.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .