Oman's Personal Data Protection Law has been in force since 13 February 2023, and the extended transition period ended on 5 February 2026. Every controller must now have a data protection officer, breaches go to the regulator within 72 hours, and cross-border transfer violations can cost up to OMR 500,000. This guide sets out what changed and what to fix first.
Timeline: from decree to enforcement
The law was promulgated by Royal Decree No. 6 of 2022 and published in the Official Gazette on 13 February 2022. It came into force a year later, on 13 February 2023. The Ministry of Transport, Communications and Information Technology (MTCIT) issued the Executive Regulations, Ministerial Decision No. 34 of 2024, on 28 January 2024. A one-year compliance period started on 5 February 2024. Ministerial Decision No. 6 of 2025 extended it, and the extended transition ended on 5 February 2026. There is no longer a grace period.
| Date | Event |
|---|---|
| 13 February 2022 | PDPL published in the Official Gazette |
| 13 February 2023 | PDPL in force |
| 28 January 2024 | Executive Regulations issued by MTCIT |
| 5 February 2024 | One-year compliance period starts |
| 5 February 2026 | Extended transition ends (Ministerial Decision No. 6 of 2025) |
Consent is the foundation
Oman relies on express, provable consent as its basis for processing. Article 10 requires express consent from a person with full capacity and proof of written consent. The Executive Regulations add that consent must be clear, not forced, and recorded in writing, electronically or in another set form. Individuals can revoke consent. Store a time-stamped record of each consent, the notice version shown and any later withdrawal, because the burden of proof sits with the controller.
Every controller needs a DPO
Unlike the UAE, Saudi and ADGM rules, which require a DPO only in defined cases, Oman's Executive Regulations make a data protection officer mandatory for every controller, and the DPO's contact details must be public. The privacy notice given before processing must include those DPO details. Controllers must also keep records of processing that cover purposes, data categories, recipients, transfers and retention. Name the DPO as the owner of that record so it is reviewed whenever a new system or vendor is added.
Sensitive data, children and marketing
Processing sensitive data requires a permit from MTCIT. The ministry decides within 45 days and a permit is valid for five years. Plan the application into product launch dates. Children's data needs express parental consent, and processing must be for a clear and safe purpose, use the minimum data needed and be in the child's best interest. Direct marketing needs written consent and an unsubscribe mechanism in every message.
Breach notification
A controller must notify MTCIT within 72 hours of becoming aware of a breach likely to endanger data subjects' rights. Where severe damage or high risk is likely, affected individuals must be told within the same 72 hours. Notifying individuals inside 72 hours is stricter than in many regimes, which only require notice without undue delay. Prepare template messages in Arabic and English so they can go out quickly.
Cross-border transfers
Transfers outside Oman need the data subject's explicit consent, unless an international agreement applies or the data is anonymised. The recipient must give protection no lower than the PDPL. This is a consent-led model, unlike Saudi Arabia's adequacy and safeguards approach or Bahrain's 83-country whitelist. Fines for cross-border violations reach OMR 500,000, so review where your cloud hosting, backups and support teams sit before assuming data stays in Oman.
Penalties
The penalties in the PDPL and the Executive Regulations work at two levels: fines set in the law itself for specific violations, and administrative fines and sanctions added by the regulations. Treat the transfer and breach rules as the highest priority, since they carry the largest stated amounts.
| Violation | Penalty |
|---|---|
| Cross-border transfer violations | Up to OMR 500,000 |
| Breach notification failures | Up to OMR 20,000 |
| Administrative fines under the Executive Regulations | Reported at up to OMR 2,000 per violation |
| Other sanctions | Suspension or cancellation of permits |
What to fix first
With the transition over, check four things this quarter: a named DPO with public contact details, written proof of consent, MTCIT permits for any sensitive data, and a transfer basis for each destination outside Oman. Retention violations are also fined, so set retention periods for each data category. XDQ xAgents (https://xagents.xdqlabs.com) can review an Oman privacy notice for the DPO details, consent wording and transfer statements the regulations expect. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
Has Oman's PDPL transition period ended?
Yes. The one-year compliance period began on 5 February 2024 and was extended by Ministerial Decision No. 6 of 2025. The extended transition ended on 5 February 2026, so the law and its Executive Regulations now apply in full.
Does every company in Oman need a DPO?
Yes. The Executive Regulations require every controller to appoint a data protection officer and make the DPO's contact details public. The privacy notice given before processing must include the DPO details.
What is the fine for illegal data transfers in Oman?
Up to OMR 500,000 under the PDPL. Transfers abroad need explicit consent, unless an international agreement applies or the data is anonymised, and the recipient must offer protection no lower than the PDPL.
How long does an MTCIT sensitive data permit take?
MTCIT decides on a permit application within 45 days, and a permit is valid for five years. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Al Tamimi: New Omani Personal Data Protection Law comes into force, Al Tamimi & Company, 2023
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
- CMS: Oman personal data protection law entering the enforcement phase, CMS
- Clyde & Co: Regulatory guidelines on the Qatar Personal Data Protection Law, Clyde & Co, 2021
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Trowers & Hamlins: Bahrain enhances its data protection regime (2022 resolutions), Trowers & Hamlins, 2022
