Oman

Art. 1 defines biometric data as personal data resulting from specific technical processing relating to physical, psychological, or behavioral characteristics, such as a facial image or genetic fingerprint data, naming a facial image as a worked example.

Art. 5 prohibits processing genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or security-measures data, except after obtaining a Ministry permit under controls and procedures the Executive Regulations set out.

New Art. 5 bis, added by Royal Decree No. 68/2026, excepts three cases from that rule: the personal data of those working for the controller, where the processing is part of the controller's internal work organization, follows the Law, and discloses nothing to third parties without the data subject's written consent; processing through surveillance devices and cameras used to meet security requirements issued by the competent authorities; and other cases the Minister fixes by decision.

This is a prior-permit model, structurally the same heightened gate found in Bahrain: outside those cases, a service cannot rely on the Data Subject's consent alone to process biometric data in Oman. No modality-specific voice provision exists beyond the general definition, which would still reach a voiceprint as a behavioral characteristic enabling identification.

The Law sets no retention period or destruction duty specific to biometric data, and replacement Article 15 requires the controller and the processor to erase personal data immediately upon the end of the purpose of its processing, save for an existing dispute or a legal obligation.

The Royal Decree requires the Controller, in the event of a personal data breach leading to destruction, alteration, disclosure, access, or illegal processing, to notify the Ministry and the Data Subject of the breach, in accordance with the controls and procedures the Executive Regulations set.

The Ministry's guidance on the Law and its Executive Regulations states that the controller must notify the Ministry within 72 hours of becoming aware of any breach that threatens the rights of affected data subjects. The same guidance states that the controller must notify the data subject within 72 hours if the breach poses serious harm or high risk.

Art. 2, as replaced by Royal Decree No. 68/2026, applies the Law to the processing of personal data of natural persons in Oman, whether the processing takes place inside or outside Oman.

Art. 3, as replaced, excludes six kinds of processing from the Law's scope: national security and the public interest, the statutory functions of state administrative bodies and other public legal persons, protection of the state's economic and financial interests, crime detection or prevention on a formal written request from an investigating authority, processing by an individual in a personal or family setting unless the data is published, and historical, scientific, statistical, literary or economic research and statistics by authorized bodies that cannot be traced to an identifiable person.

Art. 4 sets a general coverage default for anything not excluded: personal data is protected under the Law.

The Ministry of Transport, Communications and Information Technology implements the Law under Art. 7, as replaced: it prepares the controls and procedures for protecting personal data, issues the procedures for processing and for checking that controllers and processors comply, receives and decides complaints, cooperates with foreign data protection bodies, advises and coordinates with state bodies, and accredits the external auditors who assess compliance.

Article 10, as replaced by Royal Decree No. 68/2026, requires the controller to prove the data subject's express consent to the processing of the data subject's personal data. Article 16 requires the controller and processor, at the Ministry's request, to appoint an external auditor to verify that the processing was carried out under the Law, and to give the Ministry a copy of the auditor's report.

Article 17 requires the controller and processor to keep documents of processing operations for the periods and under the procedures the Executive Regulation sets.

Art. 23 permits a Controller to transfer personal data outside Oman, and to allow its transfer, in accordance with the controls and procedures the Executive Regulations set, without prejudice to the Cyber Defence Centre's own competences, and bars the transfer of personal data that was processed in breach of the Law or whose transfer would harm the data subject. The Law states no adequacy test and no list of approved countries.

The Ministry's guidance on the Law and its Executive Regulations states that, as a rule, the controller must obtain the data subject's consent before transferring personal data abroad, with exceptions where the transfer is required to fulfill an international obligation under a treaty to which Oman is a party or is carried out in a way that ensures the data subject cannot be identified.

The same guidance states that approval from the Cyber Defence Centre is required only where sensitive personal data will be stored or processed outside Oman, and that for non-sensitive data no other authority's approval is required, provided the transfer complies with the safeguards in the Regulations. A violation of Article 23 carries the highest fine tier in the Law (100,000 to 500,000 Rial Omani).

Art. 11 gives the data subject six rights: (a) revoke consent to processing, without affecting processing that already took place, (b) request amendment, updating, or blocking of their personal data, (c) obtain a copy of their processed personal data, (d) transfer their personal data to another controller (portability), (e) request erasure, unless processing is necessary for national archiving and documentation, and (f) be notified of any breach or infringement of their personal data and the actions taken in response.

No separate right to object to processing was found in Art. 11; the closest analog is the consent-revocation right at (a), which is narrower since it presupposes the processing rested on consent. Art. 12 separately gives a right to complain to the Ministry. These rights apply to a data subject's personal data generally, biometric identifiers included, since Art. 11 is not limited to any particular data category.

Art. 8 gives the Ministry power to warn, order rectification or erasure, suspend processing (temporarily or permanently), and suspend cross-border transfer for a violation of the Law.

A five-tier fine structure by article violated: 500-2,000 Rial Omani for Art. 10 violations (Art. 25, as replaced by Royal Decree No. 68/2026); 1,000-5,000 for Arts. 15-18, 20, 22 (Art. 26); 5,000-10,000 for Arts. 13 and 14 (Art. 27, as replaced); 15,000-20,000 for Arts. 5, 6, 19, 21 (Art. 28, including the biometric or sensitive-data permit requirement and child-data processing); and 100,000-500,000, far the highest tier, for Art. 23 (cross-border transfer) violations (Art. 29).

A legal person is separately fined 5,000-100,000 Rial Omani where the violation is committed in its name or on its account by its chair, a board member, its manager or another responsible person, with that person's consent, concealment or gross negligence, without prejudice to the criminal liability of natural persons (Art. 30). The Law states no private right of action; enforcement runs through the Ministry's measures and the fines in Chapter Five.

Article 5 (Chapter Two, Encroachment on Data or Electronic Information and Information Systems) punishes whoever intentionally, without right, enters a website, an information system, or an information-technology means, or exceeds authorized access to it, or continues access once aware it is unauthorized, with imprisonment of one to six months and a fine of 100 to 1,000 Omani Rial, or either penalty.

Where that access results in the deletion, alteration, addition, modification, distortion, damage, copying, destruction, blocking, encryption, disclosure, or republication of data or electronic information, or in destroying the website, harming its users, or occupying its domain name or address, the penalty rises to imprisonment of six months to one year and a fine of 1,000 to 3,000 Omani Rial, or either penalty.

Where the data or electronic information reached under that second paragraph is personal data, the penalty rises again to imprisonment of one to three years and a fine of 2,000 to 5,000 Omani Rial, or either penalty. A guardian, custodian, curator, or caregiver who acted to protect the interest of a person lacking or having diminished legal capacity is exempted from punishment.

The Decree's own text states it takes effect the day after its Official Gazette publication and was issued on 15 Dhul Hijjah 1447H (1 June 2026), repealing the prior cybercrime law issued by Royal Decree No. 12/2011. It was published in Official Gazette issue 1651 of 7 June 2026, so it took effect on 8 June 2026.

Article 4 excludes mere ideas, procedures, working methods, mathematical concepts, principles, discoveries, and data from copyright protection, along with official documents and news of the day and current events that are mere journalistic information, though a compilation or arrangement of that excluded material is protected where it is itself distinguished.

Article 20 permits, without the author's consent, quoting paragraphs from a protected work lawfully made available to the public for clarification, explanation, or criticism, to the extent justified by that purpose, and permits the lawful owner of a copy of a computer program to reproduce a single copy for the purpose and extent the program was obtained, for archival purposes, or to replace a lost or destroyed copy.

Neither Article 20 nor any other section located creates a text-and-data-mining exception or a machine-readable reservation mechanism, so training a model on scraped Omani-copyrighted text or copying more than the narrow free-uses allowance rests on none of the Law's own exceptions.

Article 52 punishes copyright infringement, without prejudice to a more severe sanction under any other law, with imprisonment of three months to three years and a fine of 2,000 to 10,000 Omani Rial, or either penalty.

Article 2(b) lists computer programs and databases, whether machine-readable or otherwise, among the categories of protected works. Article 3(c) narrows that to compilations of data or other material, whether in machine-readable or other form, which by reason of the selection and arrangement of their contents constitute intellectual creations, without prejudice to any copyright subsisting in the underlying content.

No separate sui generis or producer's database right, of the kind the European Union's Database Directive creates, was located in the sections read; a merely comprehensive, non-creatively-arranged database compiled by a scraper's target falls outside this protection, and Article 4's exclusion of mere data from copyright protection means the underlying facts a scraper extracts are not themselves protected even where the compiler's selection or arrangement is.

Royal Decree No. 68/2026 replaced Article 3, which no longer lists lawfully publicly available data among the processing excluded from the Personal Data Protection Law (the former Art. 3(j)).

Replacement Article 2 applies the Law to the processing of personal data of natural persons in Oman, inside or outside Oman, and replacement Article 3 excludes only a short list of processing: national security and the public interest, the statutory functions of state bodies, protection of the state's economic and financial interests, crime detection or prevention on a formal written request, personal or family processing unless the data is published, and de-identified research and statistics.

Public availability now matters only as an exception to the express-consent rule in Article 10: new Article 10 bis, item (b), lets a controller process personal data without that consent where the data is available to the public and the processing does not contravene the Law.

A scraper collecting personal data of an individual in Oman from a public page therefore remains subject to the Law's other duties (security, purpose limitation, cross-border transfer, breach notification), and a biometric identifier such as a faceprint or voiceprint derived from publicly posted photographs, video, or audio still needs a Ministry permit under Art. 5, which Article 10 bis does not lift.

The Framework is effective from the date of issuance unless otherwise specified. Article 5 requires an applicant to comply with Annexure 3, the Open Banking Data and Information Security Specification, to obtain a license, and requires the licensee to continue to comply with it while providing Open Banking Services.

Article 6.8.3 requires licensees to comply with Annexure 3 to mitigate the cybersecurity risks that arise from the use of APIs for interconnectivity between licensees and banks, payment service provider licensees or financial institutions. Annexure 3 states that new technology deployments must undergo security testing before go-live. Annexure 3 states that logging mechanisms should record both successful and unsuccessful occurrences of security events.

Article 10.1 provides that the Central Bank may, after due process, carry out remedial action or impose penalties on a non-compliant licensee as applicable under the National Payment Systems Law and the Banking Law.

The Framework is effective from the date of issuance unless otherwise specified. Article 6.6.3(c)(ii) requires a licensee to notify the Central Bank of major operational or security incidents that have or could have a significantly negative impact on the financial interests of customers, banks, payment service provider licensees or financial institutions, or the licensee itself.

Article 6.6.3(c)(i) requires a licensee to notify the Central Bank of incidents where there is knowledge or suspicion of fraud committed or intended against customers or the licensee itself. Annexure 3 states that any security breach resulting in loss, alteration, unauthorized disclosure or access to data, or any cybersecurity incident such as malware, ransomware or denial-of-service attacks, must be promptly reported to the relevant authorities.

Article 10.1 provides that the Central Bank may, after due process, carry out remedial action or impose penalties on a non-compliant licensee as applicable under the National Payment Systems Law and the Banking Law.

Article 4 excludes ideas, procedures, working methods, mathematical concepts, principles, discoveries, and data from copyright protection, and separately excludes official documents and news of the day and current events that are mere journalistic information; a compilation or arrangement of that excluded material, or any creation or intellectual effort behind it, is nonetheless protected where it is itself distinguished.

Article 20(4) permits the press to reproduce, broadcast, or make available to the public portions of articles published in newspapers or periodicals on current economic, political, or religious topics, and broadcast works of the same character, provided the right owner did not expressly reserve that right at the time of publication.

The Law creates no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no hot-news or misappropriation doctrine distinct from ordinary copyright law, and it predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists either.