Briefing · Oman · 1 October 2026
Oman amends its data protection law: what Royal Decree 68/2026 changes
Seven months after enforcement began, Oman has amended its Personal Data Protection Law. The change widens who it reaches and eases two permit burdens, but the fines most organisations underestimate are unchanged.
What happened
Royal Decree 68/2026, amending Royal Decree 6/2022, was published by the Ministry of Transport, Communications and Information Technology on 6 September 2026 and is in force. It comes seven months after the law became enforceable on 5 February 2026.
What changes
- Reach. The law now applies to processing of personal data of people in Oman whether it takes place inside or outside the Sultanate (Article 2, as amended). A group running HR, CRM or analytics for Omani staff or customers from Dubai, Riyadh or London is plainly in scope.
- Staff data and CCTV. A new Article 5bis lets a controller process its own employees’ data, including biometrics such as fingerprints, and security-camera footage required by the competent authorities, without first obtaining the ministry permit that sensitive data otherwise needs.
- Automated decisions. Individuals gain a right to object to decisions made solely by automated processing and to ask for a person to review them.
- Consent and erasure. More specific requirements for how consent is requested, explicit consent for marketing, additional cases where processing is allowed without explicit consent, and a duty to erase data once its purpose ends.
What has not changed
The penalties chapter still carries fines of up to OMR 500,000 for the most serious offences and up to OMR 100,000 for legal persons, alongside administrative fines of up to OMR 2,000 per violation. The unconditional requirement to appoint a data protection officer, and the 72-hour breach notification to the ministry, also stand.
What is worth doing now
- Confirm whether any system outside Oman processes data about people in Oman. If it does, it is now in scope on its face.
- If you paused a biometric attendance or CCTV project waiting for a permit, check whether Article 5bis now covers it, and record the basis.
- List decisions about Omani customers or staff that are made entirely by a system, such as credit, eligibility or screening, and set up a route for objection and human review.
- Update the privacy notice, which is customarily in Arabic, to reflect the new rights.
The question your board should ask
“Which of our systems, inside or outside Oman, make decisions about people in Oman without a human in the loop, and how would someone object?”
Primary sources
- Personal Data Protection Law and Royal Decree 68/2026 (MTCIT)
- Royal Decree 6/2022, consolidated text including 2026 amendments (Decree.om)
Checked 1 October 2026. This briefing is not legal advice. We never assess work we have advised on, and we never sell the fix for anything we assess.
Need an independent view of your Oman position?
We assess where you stand against the amended law, including your DPO arrangements and any processing outside Oman.