Oman amends its data protection law: what Royal Decree 68/2026 changes
1 October 2026
Wider reach outside Oman, no permit for staff biometrics or CCTV, a right to object to automated decisions. The fines are unchanged.
Briefings
Gulf briefings
Short, sourced notes on what has changed in Gulf cyber, data protection and AI regulation, and the question your board should ask about it. Every claim links to the issuing authority. Published in English and Arabic.
Latest
The UAE Central Bank’s new operational risk regulation: what boards of licensed firms now own
1 October 2026
In force 14 September 2026 for every licensed financial institution: board ownership, independent pen testing of critical functions, third-party risk.
The UAE’s new Federal Authority for AI and Data, and the data protection rules still waiting for it
1 October 2026
A single federal body for AI, data and digital government, created June 2026. The federal PDPL executive regulations are still unpublished.
How we write these
Each briefing is checked against the regulator’s own text on the date shown. Where press reports and the published text disagree, we say so. We never assess work we have advised on, and we never sell the fix for anything we assess.
Something changed that affects you?
Tell us what you are dealing with and which GCC states you operate in.