We, Haitham bin Tarik, the Sultan of Oman
after perusal of the Basic Statute of the State,
and the Personal Data Protection Law issued by Royal Decree 6/2022,
and after presentation to Majlis Oman,
and in pursuance of public interest,
have decreed as follows
Article I
The attached amendments to the mentioned Personal Data Protection Law are hereby implemented.
Article II
All that is contrary to the attached amendments, or in conflict with their provisions, is hereby repealed.
Article III
This decree must be published in the Official Gazette, and comes into force on the day following the date of its publication.
Issued on: 21 Rabi Al-Awwal 1448
Corresponding to: 3 September 2026
Haitham bin Tarik
Sultan of Oman
Published in Official Gazette 1664 issued on 6 September 2026.
Amendments to Some Provisions of the Personal Data Protection Law
Article 1
The definitions of “health data” and “controller” provided in article 1 of the mentioned Personal Data Protection Law are hereby replaced with the following definitions:
– Health data:
Personal data relating to the health condition of an individual, whether physical, mental, or psychological, or relating to the provision of health care services to him, which reveal his health status.
– Controller:
The legal person who carries out the processing himself or entrusts it to the processor.
Article 2
The texts of articles 2, 3, 7, 10, 14, 15, 22, 25, and 27 of the mentioned Personal Data Protection Law are hereby replaced with the following texts:
Article 2
The provisions of this law apply to the processing of personal data of natural persons in the Sultanate of Oman, whether the processing is carried out inside or outside the Sultanate of Oman.
Article 3
The provisions of this law do not apply to the processing of personal data carried out in the following cases:
(a) Protection of national security or public interest.
(b) Implementation of the units of the administrative apparatus of the state and other public legal persons of the competences prescribed to them by law.
(c) Protection of the economic and financial interests of the state.
(d) Detection or prevention of a crime on the basis of a formal written request by the investigation entities.
(e) The processing of personal data by a person within the personal or family sphere, unless it is published.
(f) For the purposes of historical, statistical, scientific, literary, or economic research, by entities authorised to carry out such works, provided that no indication or reference relating to the data subject is used in the published research and statistics, to guarantee that the personal data is not attributed to an identified or identifiable natural person.
Article 7
Without prejudice to the competences prescribed to the Cyber Defence Centre, the ministry shall undertake the responsibility of implementing the provisions of this law, and in particular the following:
(a) Preparing and adopting the controls and procedures relating to the protection of personal data, including determining the necessary safeguards, required measures, and code of conduct relating to the protection of personal data.
(b) Issuing the necessary controls and procedures for processing personal data and verifying the compliance of the controller and processor with them.
(c) Receiving reports and complaints filed by data subjects and deciding on them, within the period specified by the regulation.
(d) Cooperating with the entities competent with the protection of personal data in other states.
(e) Providing advice and support to, and coordinating with, units of the administrative apparatus of the state and other public legal persons in any matter relating to the protection of personal data.
(f) Approving external auditors entrusted with evaluating the compliance of the controller and the processor with the provisions of this law.
Article 10
It is not permitted to process personal data or change the purpose of its processing except within the framework of transparency, honesty, and respect for human dignity, and after obtaining the explicit consent of the data subject. The controller shall prove the explicit consent of the data subject to process his data.
The request for consent to process personal data must be written in a clear, explicit, and understandable manner, and must include the following:
(a) The details of the controller and the processor (if any).
(b) The mechanism for contacting the personal data protection officer.
(c) The objectives and nature of the processing.
(d) Any other information that may be necessary to fulfil the conditions for processing in accordance with the provisions of this law.
Article 14
The controller and the processor shall, when using automated processing, take the appropriate procedures and measures to protect the privacy and confidentiality of personal data, and not to cause harm to the data subject.
In all cases, the data subject has the right to object to the decisions resulting from automated processing, and the controller or the processor shall introduce the human element when reviewing the objected-to decisions, in accordance with the controls determined by the regulation.
Article 15
The controller and the processor shall erase personal data immediately upon the end of the purpose of its processing. As an exception to this, they shall retain it in the following two cases:
(a) Presence of an existing dispute between the controller or processor and the data subject.
(b) Implementation of a legal obligation imposed on the controller or processor by virtue of any law, judgment, order, or decision by the court.
Article 22
The controller shall obtain the explicit consent of the data subject prior to transmitting to him any advertising or marketing material of a commercial nature, in the manner determined by the regulation.
Article 25
Whoever violates the provisions of article 10 of this law shall be punished by a fine no less than 500 (five hundred) Rial Omani and not exceeding 2,000 (two thousand) Rial Omani.
Article 27
Whoever violates the provisions of articles 13 and 14 of this law shall be punished by a fine no less than 5,000 (five thousand) Rial Omani and not exceeding 10,000 (ten thousand) Rial Omani.
Article 3
A new definition is hereby added to article 1 of the mentioned Personal Data Protection Law with the following text:
Automated processing:
Processing carried out using an electronic programme or system that operates in an automated and automatic manner, either completely independently without any human involvement, or partially with limited human supervision and involvement.
Article 4
Two new articles numbered 5bis and 10bis are hereby added to the mentioned Personal Data Protection Law with the following text:
Article 5bis
In exception to the provisions of article 5 of this law, the controller may process personal data in the following cases:
1. Processing of the personal data of those working for the controller, in accordance with the following conditions:
(a) That the processing is within the framework of governing the internal operations of the controller.
(b) That the processing is carried out in accordance with the provisions of this law.
(c) Not disclosing the personal data to third parties except after obtaining the written consent of the data subject.
2. Processing of personal data carried out through surveillance devices and cameras used to fulfil the security requirements issued by the competent entities.
3. Any other cases specified by a decision by the minister, in accordance with the controls specified by the regulation.
Article 10bis
In exception to the provisions of article 10 of this law, it is permitted to process personal data without obtaining the explicit consent of the data subject in the following cases:
(a) If the processing is in implementation of a legal obligation imposed on the controller by virtue of any law, judgment, order, or decision by the court.
(b) If the data is available to the public in a manner that is not contrary to the provisions of this law.
(c) Protection of a vital interest of the data subject in the event that it is not possible to contact him.
(d) If the processing is in the execution of a contract to which the data subject is a party, provided that the contract includes evidence that the processing of personal data is done in accordance with the provisions of this law.