OmanPersonal Data Protection Law, breach notification
Royal Decree No. 6/2022, Art. 19, breach notification provision
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a breach leading to the destruction, alteration, disclosure, access, or illegal processing of an individual's personal data in Oman must notify the Ministry and the affected Data Subject, following the procedure the Executive Regulations set; the Ministry's guidance puts the notice to the Ministry at 72 hours from awareness of a breach that threatens data subjects' rights, and the notice to the Data Subject at 72 hours where the breach poses serious harm or high risk.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://mtcit.gov.om/sectors/governance/personal
- Guidance body
- Personal Data Protection Department, Ministry of Transport, Communications and Information Technology (Personal Data Protection guidance page: FAQ and guiding models)
- Open questions
- Must the controller notify the data subject of every breach under Article 19, which requires it to notify the Ministry and the data subject of the breach, or only a breach that poses serious harm or high risk?
What it makes you log
Logging duty
Article 19 requires the controller to notify the Ministry and the data subject of a breach, under the controls and procedures the Executive Regulation sets. It states no duty to document the breach or keep a register of breaches, and names no check on one. The Executive Regulation (Ministerial Decision 34/2024) is outside the row's cited text.
- Kind
- None
- As of
What this law does
The Royal Decree requires the Controller, in the event of a personal data breach leading to destruction, alteration, disclosure, access, or illegal processing, to notify the Ministry and the Data Subject of the breach, in accordance with the controls and procedures the Executive Regulations set.
The Ministry's guidance on the Law and its Executive Regulations states that the controller must notify the Ministry within 72 hours of becoming aware of any breach that threatens the rights of affected data subjects. The same guidance states that the controller must notify the data subject within 72 hours if the breach poses serious harm or high risk.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .