Oman

Art. 1 defines biometric data as "personal data resulting from specific technical processing relating to the physical, psychological, or behavioural characteristics such as the facial image or the genetic fingerprint data," naming a facial image as a worked example.

Art. 5 prohibits processing genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or security-measures data, except after obtaining a Ministry permit under controls and procedures the Executive Regulations set out (not read). This is a prior-permit model, structurally the same heightened gate found in Bahrain: a service cannot rely on the Data Subject's consent alone to process biometric data in Oman.

No modality-specific voice provision exists beyond the general definition, which would still reach a voiceprint as a behavioural characteristic enabling identification. No retention-period ceiling or destruction duty specific to biometric data was found in the Royal Decree itself.

The Royal Decree requires the Controller, in the event of a personal data breach leading to destruction, alteration, disclosure, access, or illegal processing, to notify the Ministry and the Data Subject of the breach, in accordance with the controls and procedures the Executive Regulations set.

As with cross-border transfer, the duty exists in the Decree itself but its timeline, not stated as a fixed number of hours or days in the primary text read, is deferred to the Executive Regulations (Ministerial Decision 34/2024), not read at primary source.

Art. 3 excludes a list of processing activities entirely from the Law's scope: national security and public interest, state administrative functions, legal-obligation compliance, state economic and financial interest protection, vital-interest protection, crime detection or prevention on formal written request, contract performance, personal or family-sphere processing, de-identified research or statistics, and publicly available data (Art. 3(j), see the jurisdiction summary).

Art. 4 sets a general coverage default for anything not excluded: "Personal data is deemed protected by virtue of the provisions of this law." The Ministry of Transport, Communications and Information Technology implements the Law under Art. 7, issuing controls, procedures, licences, and a controller and processor register.

Art. 23 permits a Controller to transfer personal data outside Oman "in accordance with the controls and procedures determined by the regulation," without prejudice to the Cyber Defence Centre's own competences. The Royal Decree itself states no adequacy test, no whitelist, and no enumerated conditions of its own; the entire substantive transfer regime is deferred to the Executive Regulations (Ministerial Decision 34/2024), not read at primary source.

What the Decree does confirm is that a violation of Art. 23 carries by far the highest penalty tier in the whole Law (100,000 to 500,000 Rial Omani), a strong signal of seriousness even though the substantive rule is deferred. This instrument alone does not establish Oman's jurisdiction-level cross-border posture; the moderate restriction recorded at jurisdiction level rests on the Bahrain and UAE comparators in this batch, not on Oman's own Executive Regulations text.

Art. 11 gives the data subject six rights, read verbatim in full: (a) revoke consent to processing, without affecting processing that already took place, (b) request amendment, updating, or blocking of their personal data, (c) obtain a copy of their processed personal data, (d) transfer their personal data to another controller (portability), (e) request erasure, unless processing is necessary for national archiving and documentation, and (f) be notified of any breach or infringement of their personal data and the actions taken in response.

No separate right to object to processing was found in Art. 11; the closest analog is the consent-revocation right at (a), which is narrower since it presupposes the processing rested on consent. Art. 12 separately gives a right to complain to the Ministry. These rights apply to a data subject's personal data generally, biometric identifiers included, since Art. 11 is not limited to any particular data category.

Art. 8 gives the Ministry power to warn, order rectification or erasure, suspend processing (temporarily or permanently), and suspend cross-border transfer for a violation of the Law.

A five-tier fine structure by article violated (no imprisonment terms found in the sections read): 500-2,000 Rial Omani for Art. 14 violations; 1,000-5,000 for Arts. 15-18, 20, 22; 5,000-10,000 for Art. 13; 15,000-20,000 for Arts. 5, 6, 19, 21 (including the biometric or sensitive-data permit requirement and child-data processing); and 100,000-500,000, far the highest tier, for Art. 23 (cross-border transfer) violations.

A legal person is separately fined 5,000-100,000 Rial Omani where the violation is committed in its name, "without prejudice to the criminal liability of natural persons," though no imprisonment clause was independently located in the sections read. No private right of action was found; enforcement reads as Ministry-administrative with tiered fines.

Article 5 (Chapter Two, Encroachment on Data or Electronic Information and Information Systems) punishes whoever intentionally, without right, enters a website, an information system, or an information-technology means, or exceeds authorized access to it, or continues access once aware it is unauthorized, with imprisonment of one to six months and a fine of 100 to 1,000 Omani Rial, or either penalty.

Where that access results in the deletion, alteration, addition, modification, distortion, damage, copying, destruction, blocking, encryption, disclosure, or republication of data or electronic information, or in destroying the website, harming its users, or occupying its domain name or address, the penalty rises to imprisonment of six months to one year and a fine of 1,000 to 3,000 Omani Rial, or either penalty.

Where the data or electronic information reached under that second paragraph is personal data, the penalty rises again to imprisonment of one to three years and a fine of 2,000 to 5,000 Omani Rial, or either penalty. A guardian, custodian, curator, or caregiver who acted to protect the interest of a person lacking or having diminished legal capacity is exempted from punishment.

The Decree's own text states it takes effect the day after its Official Gazette publication and was issued on 15 Dhul Hijjah 1447H (1 June 2026), repealing the prior cybercrime law issued by Royal Decree No. 12/2011, but the Gazette's own publication date is not stated in the text read at primary source, so the specific commencement day is not confirmed here.

Article 4 excludes mere ideas, procedures, working methods, mathematical concepts, principles, discoveries, and data from copyright protection, along with official documents and news of the day and current events that are mere journalistic information, though a compilation or arrangement of that excluded material is protected where it is itself distinguished.

Article 20 permits, without the author's consent, quoting paragraphs from a protected work lawfully made available to the public for clarification, explanation, or criticism, to the extent justified by that purpose, and permits the lawful owner of a copy of a computer program to reproduce a single copy for the purpose and extent the program was obtained, for archival purposes, or to replace a lost or destroyed copy.

Neither Article 20 nor any other section located creates a text-and-data-mining exception or a machine-readable reservation mechanism, so training a model on scraped Omani-copyrighted text or copying more than the narrow free-uses allowance rests on none of the Law's own exceptions.

Article 52 punishes copyright infringement, without prejudice to a more severe sanction under any other law, with imprisonment of three months to three years and a fine of 2,000 to 10,000 Omani Rial, or either penalty.

Article 2(b) lists computer programs and databases, whether machine-readable or otherwise, among the categories of protected works. Article 3(c) narrows that to compilations of data or other material, whether in machine-readable or other form, which by reason of the selection and arrangement of their contents constitute intellectual creations, without prejudice to any copyright subsisting in the underlying content.

No separate sui generis or producer's database right, of the kind the European Union's Database Directive creates, was located in the sections read; a merely comprehensive, non-creatively-arranged database compiled by a scraper's target falls outside this protection, and Article 4's exclusion of mere data from copyright protection means the underlying facts a scraper extracts are not themselves protected even where the compiler's selection or arrangement is.

Article 3(j), as this jurisdiction's privacy record establishes, excludes lawfully publicly available data from the Personal Data Protection Law's scope entirely, but the exclusion is a scope exclusion qualified by a circularity clause ("in a manner not contrary to the provisions of this law") rather than a blanket carve-out for anything visible online.

A scraper collecting personal data of an individual in Oman from a page that is public but was made public in a manner the Law itself would treat as unlawful, or deriving a biometric identifier such as a faceprint or voiceprint from publicly posted photographs, video, or audio, does not benefit from Art. 3(j) and remains subject to the Law's Art. 5 prior-permit requirement for biometric and other sensitive data and its other duties (security, purpose limitation, cross-border transfer, breach notification).

Article 4 excludes ideas, procedures, working methods, mathematical concepts, principles, discoveries, and data from copyright protection, and separately excludes official documents and news of the day and current events that are mere journalistic information; a compilation or arrangement of that excluded material, or any creation or intellectual effort behind it, is nonetheless protected where it is itself distinguished.

Article 20(4) permits the press to reproduce, broadcast, or make available to the public portions of articles published in newspapers or periodicals on current economic, political, or religious topics, and broadcast works of the same character, provided the right owner did not expressly reserve that right at the time of publication.

The Law creates no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no hot-news or misappropriation doctrine distinct from ordinary copyright law, and it predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists either.