Your Rights Under Oman's PDPL (2026 Legal Guide) — Rules & Requirements
About this article
Sourced from Omani royal decrees, ministerial decisions, and the Basic Statute of the State. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Oman's Personal Data Protection Law (PDPL — Royal Decree 6/2022) is the Sultanate's first comprehensive data protection statute. It was issued on 9 February 2022, came into initial force on 13 February 2023, and is fully enforceable from 5 February 2026 (transition period just ended). The Executive Regulations (Ministerial Decision 34/2024) came into force on 5 February 2024.
The regulator is the Ministry of Transport, Communications and Information Technology (MTCIT). Data subjects have rights of access, rectification, deletion, withdrawal of consent, and objection to processing.
When does it apply?
- A company in Oman holds your personal data and refuses to disclose / correct / delete it.
- You withdraw consent but data continues to be processed.
- You are a victim of a data breach.
- A bank, telecom, hospital, or government agency discloses your sensitive data without lawful basis.
Using Your Rights Under Oman's PDPL
- Start with a written request to the data controller. Cite PDPL Royal Decree 6/2022 and the specific right.
- If refused, escalate to MTCIT. File via the MTCIT complaint channel.
- For banking data, file in parallel with CBO Customer Complaint.
- For criminal-side disclosure offences, file with Royal Oman Police under the Cyber Crime Law.
What should you NOT do?
- Don't skip the controller's internal channel.
- Don't disclose more identification data than necessary.
- Don't pay 'data removal services' upfront.
About Data Privacy & Digital Rights in Oman
Oman entered full data-rights enforcement on 5 February 2026, when the transition period for the Personal Data Protection Law (PDPL — Royal Decree 6/2022) ended. The PDPL entered initial force on 13 February 2023; the Executive Regulations (Ministerial Decision 34/2024) came into force on 5 February 2024. The regulator is the Ministry of Transport, Communications and Information Technology (MTCIT).
For NCII and unauthorised intimate imagery, the criminal framework is the Cyber Crime Law (Royal Decree 12/2011) content-crimes provisions — penalties range from a fine to imprisonment up to 15 years depending on the offence. Investigation runs through Royal Oman Police. Victims should also use StopNCII.org (18+) or takeitdown.ncmec.org (under-18) — both free, both work in Oman.
Common Questions
Is the Oman PDPL fully in force?
Yes — the transition period ended on 5 February 2026 and the PDPL is now fully enforceable. The Executive Regulations (Ministerial Decision 34/2024) came into force on 5 February 2024; controllers had a transitional window to come into compliance by 5 February 2026.
Who regulates?
The Ministry of Transport, Communications and Information Technology (MTCIT) is the regulator. The Executive Regulations specify the procedural framework for compliance, data-subject requests, and breach notification.
What are the penalties?
The PDPL sets administrative and criminal penalties for violations; specific fine ranges and imprisonment terms should be verified against the gazetted text and the Executive Regulations for the exact provision at issue.
Does the PDPL apply to foreign companies?
The PDPL applies to processing of personal data of Omani residents and within Oman. Foreign companies with Omani operations or processing Omani residents' data should treat the law as having practical reach via MTCIT enforcement.
What is the your rights under oman's personal data protection law (pdpl) right in Oman?
Oman's Personal Data Protection Law (PDPL — Royal Decree 6/2022) is the Sultanate's first comprehensive data protection statute. It was issued on 9 February 2022, came into initial force on 13 February 2023, and is fully enforceable from 5 February 2026 (transition period just ended). The Executive Regulations (Ministerial Decision 34/2024) came into force on 5 February 2024.The regulator is the Ministry of Transport, Communications and Information Technology (MTCIT). Data subjects have rights of access, rectification, deletion, withdrawal of consent, and objection to processing.
When does it apply — your rights under oman's personal data protection law (pdpl)?
A company in Oman holds your personal data and refuses to disclose / correct / delete it.You withdraw consent but data continues to be processed.You are a victim of a data breach.A bank, telecom, hospital, or government agency discloses your sensitive data without lawful basis.
What rights do I have under Oman's Personal Data Protection Law?
Start with a written request to the data controller. Cite PDPL Royal Decree 6/2022 and the specific right.If refused, escalate to MTCIT. File via the MTCIT complaint channel.For banking data, file in parallel with CBO Customer Complaint.For criminal-side disclosure offences, file with Royal Oman Police under the Cyber Crime Law.
What should you NOT do — your rights under oman's personal data protection law (pdpl)?
Don't skip the controller's internal channel.Don't disclose more identification data than necessary.Don't pay 'data removal services' upfront.