Data Protection in Oman (2026 Legal Guide) — Rules & Requirements
About this article
Sourced from Omani royal decrees, ministerial decisions, and the Basic Statute of the State. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Oman's Personal Data Protection Law (2022) gives individuals control over their personal data and regulates how businesses handle it:
- Consent: Organisations must obtain your clear consent before collecting, processing, or sharing your personal data.
- Purpose limitation: Data can only be used for the specific purpose for which it was collected — not repurposed without your permission.
- Right to access: You have the right to request a copy of all personal data an organisation holds about you.
- Right to correction and deletion: You can ask for data to be corrected if inaccurate or deleted when no longer needed.
- Data breach notification: Organisations must notify the authorities and affected individuals of data breaches within a specified period.
- Penalties: Violations can result in fines and criminal prosecution.
When does it apply?
- A company collects your personal information (name, phone, email, civil ID number, location data) in Oman.
- Your data has been shared without your consent or used for a purpose you did not agree to.
- You suspect a data breach has exposed your personal information.
What to Do If a Company in Oman Uses or Shares Your Personal Data Without Consent
- Read privacy policies before providing personal data to any organisation.
- Exercise your right to access — request a copy of your data from any company that holds it.
- If your data has been misused, file a complaint with the Ministry of Transport, Communications and Information Technology (MTCIT).
- Request deletion of your data from companies you no longer do business with.
What should you NOT do?
- Do not share personal data with unverified companies or websites.
- Do not ignore data breach notifications — change your passwords and monitor your accounts immediately.
- Do not consent to broad data collection without understanding what data is being collected and why.
About Consumer Rights in Oman
Your consumer rights in Oman sit under the Consumer Protection Law (Royal Decree 66/2014), enforced by the independent Consumer Protection Authority (CPA) — hotline 1222. You can return defective products and challenge deceptive advertising, price manipulation, and counterfeits. Products must meet DGSM standards and carry Arabic labelling. E-commerce sits under Royal Decree 69/2008; data privacy under the Personal Data Protection Law (Royal Decree 6/2022), which gives you rights to access, correct, and delete your data. Bank and finance complaints go to the Central Bank of Oman.
Common Questions
What is the personal data protection right in Oman?
Oman's Personal Data Protection Law (2022) gives individuals control over their personal data and regulates how businesses handle it:Consent: Organisations must obtain your clear consent before collecting, processing, or sharing your personal data.Purpose limitation: Data can only be used for the specific purpose for which it was collected — not repurposed without your permission.Right to access: You have the right to request a copy of all personal data an organisation holds about you.Right to correction and deletion: You can ask for data to be corrected if inaccurate or deleted when no...
When does it apply — personal data protection?
A company collects your personal information (name, phone, email, civil ID number, location data) in Oman.Your data has been shared without your consent or used for a purpose you did not agree to.You suspect a data breach has exposed your personal information.
What should I do if I discover a company in Oman has shared or misused my personal data?
Read privacy policies before providing personal data to any organisation.Exercise your right to access — request a copy of your data from any company that holds it.If your data has been misused, file a complaint with the Ministry of Transport, Communications and Information Technology (MTCIT).Request deletion of your data from companies you no longer do business with.
What should you NOT do — personal data protection?
Do not share personal data with unverified companies or websites.Do not ignore data breach notifications — change your passwords and monitor your accounts immediately.Do not consent to broad data collection without understanding what data is being collected and why.