OmanPersonal Data Protection Law, enforcement and penalties
Royal Decree No. 6/2022, Art. 8, penalties provisions, as amended by Royal Decree No. 68/2026
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Oman must comply with a Ministry warning, an order to rectify or erase personal data, or a temporary or permanent suspension of processing or of cross-border transfer issued for a violation of the Law.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models) (guidance, recorded ).
Who enforces it
Settledness
Royal Decree 68/2026 replaced Articles 25 and 27 of the Law, which now fix the fine tiers for violations of Article 10 and of Articles 13 and 14.
- As of
- Guidance link
- https://mtcit.gov.om/sectors/governance/personal
- Guidance body
- Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models)
- Open questions
- May the Ministry impose an Article 32 administrative fine on top of a court-imposed fine under Articles 25 to 29 for the same violation, given that Article 32 applies without prejudice to the punishments the Law prescribes?
What it makes you log
Logging duty
Article 8 gives the Ministry power to warn, order rectification or erasure and suspend processing or cross-border transfer, and Articles 25 to 30 set the fines; none of them requires a log or record or gives the Ministry a power to demand one. Article 26 fines a breach of Articles 15 to 18, 20 and 22, which include the Article 16 external audit and the Article 17 duty to keep processing documents; those duties sit in articles the row does not cite, so the row records no logging duty of its own.
- Kind
- None
- As of
What this law does
Art. 8 gives the Ministry power to warn, order rectification or erasure, suspend processing (temporarily or permanently), and suspend cross-border transfer for a violation of the Law.
A five-tier fine structure by article violated: 500-2,000 Rial Omani for Art. 10 violations (Art. 25, as replaced by Royal Decree No. 68/2026); 1,000-5,000 for Arts. 15-18, 20, 22 (Art. 26); 5,000-10,000 for Arts. 13 and 14 (Art. 27, as replaced); 15,000-20,000 for Arts. 5, 6, 19, 21 (Art. 28, including the biometric or sensitive-data permit requirement and child-data processing); and 100,000-500,000, far the highest tier, for Art. 23 (cross-border transfer) violations (Art. 29).
A legal person is separately fined 5,000-100,000 Rial Omani where the violation is committed in its name or on its account by its chair, a board member, its manager or another responsible person, with that person's consent, concealment or gross negligence, without prejudice to the criminal liability of natural persons (Art. 30). The Law states no private right of action; enforcement runs through the Ministry's measures and the fines in Chapter Five.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .