Tag: Toolkit

Key Info

Title	The Conditions and Procedures for Advertising or Promoting Medicine (MOH Decision 135/2025)
Date Issued	29 May 2025
Entry into Force	30 May 2025
Scope of Application	Pharmaceutical companies, local agents, pharmaceutical consultancy offices advertising or promoting medicine; excludes scientific offices.
Note	This is a sub-regulation of the Executive Regulation of the Law Regulating the Practice of Pharmacy and Pharmaceutical Enterprises. The MOH may suspend the licence if risks or ineffectiveness of the medicine emerge, impacting ongoing advertising permissions.

Checklist

The table below identifies the key obligations under the Conditions and Procedures for Advertising or Promoting Medicine (MOH Decision 135/2025).

Article	Requirement	Notes
2	Must not advertise or promote medicine unless you are a pharmaceutical company, a local agent, or pharmaceutical consultancy office, and only after obtaining a licence from MOH.	The MOH may in all cases suspend the licence if risks or ineffectiveness of the medicine emerge, impacting ongoing advertising permissions.
3	Ensure that the medicine is registered and its advertising or promotion complies with specified content, target group, public order, health, truthfulness, and guide requirements set in article 3 of the controls.
4	Must submit an application to obtain a licence to the centre using the prescribed form, accompanied by a copy of the medicine advertisement or promotion, medicine registration certificate, evidence of payment of the prescribed fee, and any other documents or information requested by the MOH.
5	When submitting an application, must rectify any deficiencies identified by MOH in the application within 30 days, otherwise application is deemed cancelled.
6	Must submit the licence renewal application to MOH at least 20 days before the licence expiry and ensure that the renewal follows the same conditions and procedures as the initial licence grant.
7(1)	Must include the licence number in the advertisement or promotion of the medicine.
7(2)	The advertisement or promotion of the medicine must be in accordance with the form licensed by MOH.
7(3)	Must not make any modification to the advertisement or promotion of the medicine after licensing it, except after obtaining prior approval from MOH.
7(4)	The advertisement or promotion of the medicine must be limited to pharmacists.
7(5)	If the advertisement or promotion is for a medicine dispensed with a prescription, it must be made in scientific journals or conferences or by direct meetings with pharmacists, their assistants, or practitioners of the medical profession and allied health professions.

Key Info

Title	Public Private Partnership Law (Royal Decree 52/2019)
Date Issued	1 July 2019
Entry into Force	2 July 2019
Scope of Application	Partnership contracts and related consultancy contracts for public-private partnership projects involving ministries, public authorities, public establishments, and other public legal persons in Oman.
Note	Executive regulation to be issued within 1 year of entry into force. Repeals conflicting provisions.

Checklist

The table below identifies the key obligations under the Public Private Partnership Law (Royal Decree 52/2019).

Article	Requirement	Notes
7	Must submit a complete feasibility study for the project if the concept for the partnership project is accepted.
9	Must prepare the conditions and specifications document for the partnership project in coordination with the competent body, ensuring it includes essential information, project specifications, bond values, required records and procedures, objective evaluation principles guaranteeing non-discrimination, and essential contract conditions.	The conditions and specifications document must be prepared by the authority in coordination with the competent body and include non-negotiable conditions; the regulation details the preparation process.
11	Must assess submitted bids for compliance with announced conditions and specifications, disqualify non-compliant bids, evaluate compliant bids based on stated technical, financial, and legal principles, and award the partnership project to the best demonstrated bidder.
15	Must establish a project company solely for executing the announced partnership project, comply with regulations on its form and capital, and obtain written approval from the authority before executing other partnership contracts or trading shares prior to project completion.	The regulation specifies company form and capital requirements; written approval from the authority is required before executing other partnership contracts or trading shares prior to project completion.
16	Must obtain the written approval of the authority before undertaking any modification to the legal form, capital reduction, share sale or mortgage, partner share modification, merger, split, acquisition, addition of new partners, or ownership transfer of the project company, and must not mortgage shares for non-financing purposes.	Any unauthorized modifications or disposals are invalid; mortgaging shares is only permitted for financing purposes with prior written approval from the authority.
17	Must specify in the partnership contract the rights and obligations of the contracting parties, including detailed provisions on the parties, scope of work, ownership, insurance, financial obligations, licensing responsibilities, pricing, risk allocation, oversight mechanisms, modification rights, compliance with health, safety and environmental requirements, penalties, contract duration and termination, and dispute resolution.	Contract duration must not exceed 50 years; administrative penalties for project company non-compliance must be included. The competent body has unilateral termination rights under specified circumstances.
18	Must not amend the conditions of the partnership contract except in accordance with its principles, by agreement of the parties, and with the written approval of the authority.	Written approval of the Public Authority for Privatisation and Partnership is mandatory for any contract amendments, ensuring regulatory oversight.
23	Must transfer ownership of all partnership project assets to the state upon contract lapse or termination, excluding assets agreed otherwise, without judicial procedure, payment, or compensation, and any contrary disposal is invalid.	Transfer of assets to the state occurs automatically without judicial process or compensation unless otherwise agreed; any contrary acts are invalid.
25	Must not charge any financial amount for products or services under the partnership contract except after obtaining a quality acceptance certificate from the competent body in accordance with the stipulated performance standards.	Charging without a quality acceptance certificate is prohibited; no explicit penalties stated but non-compliance may lead to contract enforcement actions.
26	Must obtain the written approval of the authority and comply with specified procedures, conditions, and controls before selling, mortgaging, transferring rights or obligations, assigning execution, or arranging any mortgage or right in rem related to the partnership project land, except for financing purposes.	Any unauthorized sale, mortgage, transfer, or assignment related to project land is invalid; written approval from the authority is mandatory, ensuring strict control over project assets.
28	Must guarantee absolute equality between beneficiaries of the products or services provided by the partnership project, except when special treatment is permitted for certain beneficiary classes with equal legal status, subject to written authority approval, adherence to predetermined general rules, and approval by the competent body.	Special treatment for beneficiary classes requires written approval from the authority and approval by the competent body, ensuring adherence to predetermined general rules.
29	Must use the assets of the partnership project only for their intended purpose, undertake necessary procedures to maintain and preserve them, and not sell or dispose of them except for replacement and renewal with written approval from the authority.	Disposal of assets outside replacement and renewal requires written approval from the authority; unauthorized disposals are deemed invalid.
30	Must submit periodic reports to the competent body about all works relating to the execution of the partnership contract, including construction, preparation, maintenance, operation, and utilisation works.	Reports must be submitted periodically as specified in the regulation; the competent body forwards copies to the authority.
32	Must provide employees of the competent body with all that enables them to enter the site and related places at any time to inspect, control, and evaluate all technical, financial, administrative, health, safety, and environmental aspects of the project.	The project company must facilitate unrestricted access for competent body employees at any time, ensuring no obstruction to inspections related to technical, financial, administrative, health, safety, and environmental compliance.
33	Must provide the competent body with all information, data, documents, and papers related to the execution of the partnership project.
34	Must completely abide by and immediately implement any written orders and instructions issued by the competent body to ensure compliance with laws and regulations, proper progress, efficiency, or to avoid or remove damage.

Key Info

Title	The Personal Data Protection Law (Royal Decree 6/2022)
Date Issued	9 February 2022
Entry into Force	9 February 2023
Scope of Application	All organisations in Oman with the exception of government entities.
Note	This toolkit identifies the key obligations of data controllers. In addition to the punishments stipulated for each article, a legal person can be fined between 5,000 and 10,000 Rial Omani if the crime is committed in its name or for its account. The MTCIT can also issued administrative fines up to 2,000 Rial Omani. Even though the law has technically entered into force in 2023, it is not being implemented on the ground yet. At time of writing this toolkit, the executive regulation of the law is expected to enter into force in January 2026. Complying with this law requires complying with its executive regulation as well.

Checklist

The table below identifies the key obligations under the Personal Data Protection Law (Royal Decree 6/2022).

Article	Requirement	Notes
5	Must not process genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or those relating to security measures without obtaining a permit from the ministry and complying with the regulation.	Failure to comply results in a fine between 15,000 to 20,000 Rial Omani.
6	Must not process personal data of a child except with the approval of the guardian or if processing is in the best interest of the child, in accordance with the regulation.
10	Must obtain explicit written consent from the data subject in a clear, explicit, and understandable manner before processing personal data, and ensure that processing is conducted with transparency, honesty, and respect for human dignity. Must record proof of written consent.	Failure to comply results in a fine between 500 and 2,000 Rial Omani.
11	Must respond to data subject requests to stop processing; to amend, update, or block data; to obtain a copy of the data; to transfer data to another controller; and to erase the data. Must also notify data subject of any breach of data and actions taken in this regard.
13	Must put in place controls and procedures for processing personal data, including risk assessment, data transport and transfer procedures, technical and procedural measures to ensure lawful processing, and any other controls required by regulation.	Failure to comply results in fines ranging from 5,000 to 10,000 Rial Omani.
14	Must notify the data subject in writing of the controller and processor details, contact information of the data protection officer, purpose and source of data processing, description of processing and disclosure levels, data subject rights, and any other necessary information before processing personal data.	Failure to comply results in a fine between 500 and 2,000 Rial Omani.
15	Must abide by the controls and procedures prescribed by the ministry to ensure that the processing of personal data is done in accordance with the provisions of this law.	Failure to comply results in a fine between 1,000 and 5,000 Rial Omani; applies to both controllers and processors.
16	Must appoint an external auditor upon the ministry's request to verify compliance with the law and article 13 procedures, and provide the ministry with a copy of the auditor's report.	Failure to comply results in a fine between 1,000 and 5,000 Rial Omani.
17	Must retain the documents of the data processing operations in accordance with the periods and procedures determined by the regulation.	Failure to comply results in a fine between 1,000 and 5,000 Rial Omani.
18	Must cooperate with the ministry and provide the requested data and documents necessary for it to exercise its competences within the period determined by the regulation.	Failure to comply results in a fine between 1,000 and 5,000 Rial Omani.
19	Must notify the ministry and the data subject of any personal data breach involving destruction, alteration, disclosure, access, or illegal processing, in accordance with the prescribed controls and procedures.	Failure to comply results in a fine between 15,000 and 20,000 Rial Omani.
20	Must identify a personal data protection officer.	Failure to comply results in a fine between 1,000 and 5,000 Rial Omani.
21	Must guarantee the confidentiality of personal data and ensure its non-publication except with the prior consent of the data subject, in the manner determined by the regulation.	Failure to comply results in a fine between 15,000 and 20,000 Rial Omani.
22	Must obtain the written consent of the data subject prior to transmitting any advertising or marketing material of a commercial nature, in the manner determined by the regulation.	Failure to comply results in a fine between 1,000 and 5,000 Rial Omani.
23	Must transport personal data and permit its transfer outside Oman only in accordance with the controls and procedures determined by the regulation, and must not transport personal data processed in violation of the law or that would cause harm to the data subject.	Failure to comply results in a fine ranging from 100,000 to 500,000 Rial Omani.