( Guide · Custom software · Oman )
Oman's Personal Data Protection Law (PDPL): what your website and app must do
By OGB Labs · Published
The law, the regulations and the dates
Three instruments matter. The law itself, Royal Decree 6/2022, was issued in February 2022. The Executive Regulations, Ministerial Decision 34/2024, came into force on 5 February 2024 with a one-year grace period that the Ministry later extended by a further year, so enforcement began on 5 February 2026. Royal Decree 68/2026, published in September 2026 and in force from 7 September 2026, amended the law.
The regulator is the Ministry of Transport, Communications and Information Technology (MTCIT). Its personal data protection portal publishes the law, the regulations, permit applications, breach-report forms, a self-assessment tool and templates in Arabic and English. Law firms' summaries of the enforcement phase and the 2026 amendments are a good second read. Check the current text before you rely on any detail below: this guide was checked in October 2026.
| Instrument | What it did | Date |
|---|---|---|
| Royal Decree 6/2022 | Issued the Personal Data Protection Law | February 2022 |
| Ministerial Decision 34/2024 | Executive Regulations in force, one-year grace period | 5 February 2024 |
| Grace period extended | Compliance deadline moved by a year | to 5 February 2026 |
| Full enforcement | Ministry supervises and penalises | 5 February 2026 |
| Royal Decree 68/2026 | Amended the law: scope, legal bases, automated decisions, retention, marketing | 7 September 2026 |
Who the law applies to
- Any business that processes personal data of individuals in Oman. The 2026 amendment made the law apply whether the processing happens inside or outside Oman, so a store hosted abroad that sells to Omani customers is in scope.
- Personal data means anything that identifies a person directly or indirectly: a name, phone number, email, Civil ID number, location, device identifier, order history, or a photo.
- Controllers decide why and how data is processed: that is usually you, the business. Processors handle data for you: your hosting provider, payment gateway, email tool, CRM or the agency that runs your site. You need written terms with each processor.
- Businesses not registered in Oman but serving people in Oman are not exempt. Being small is not an exemption either.
What a website or app must do: the checklist
This is the list we work through on every website, app and online store we build in Oman. Most items are design and engineering decisions, not paperwork, which is why they are cheaper to get right at the start than to retrofit.
Map the data. Write down every field you collect, where it goes and who can see it: contact forms, checkout, sign-up, chat, analytics, cookies, app permissions, support tickets. You cannot protect what you have not listed, and the regulations require a record of processing activities.
Publish a privacy notice before collection. The law requires written notice, in Arabic, with an English version if you want one, naming the controller, the purpose and nature of processing, the source of the data, the Data Protection Officer's contact details and the person's rights. Link it from every form, checkout and app sign-up screen.
Get consent that is explicit and separate. Pre-ticked boxes and consent buried in terms do not count. Keep a record of what each person consented to and when. The 2026 amendment added legal bases that do not need consent, such as performing a contract or meeting a legal obligation, but it did not add a general 'legitimate interest' basis.
Separate marketing consent. Explicit consent is required before any commercial or marketing message by email, SMS or WhatsApp, and people must be able to opt out immediately. Build the unsubscribe link and the WhatsApp stop keyword before the first campaign.
Collect the minimum. Drop every field you do not need. A booking form does not need a date of birth; a newsletter does not need a phone number.
Delete on purpose. The amended law says personal data must be deleted immediately once the purpose for collecting it is fulfilled, unless a dispute is open or another law requires retention. Set retention rules per data type and automate the clean-up.
Build the rights into the product. People can access, correct, delete and transfer their data and withdraw consent. An account page with export and delete, plus a monitored request email, covers most cases. You must respond within 45 days.
Handle children's data with guardian consent. Processing a child's data needs the guardian's consent unless it is in the child's best interests. If your app is open to minors, design the sign-up flow for this.
Get a permit before sensitive data. Genetic, biometric, health, ethnic origin, sexual life, political or religious views and criminal records need a Ministry permit before processing. Face login, a clinic booking app that stores diagnoses, or a fitness app with medical history all fall here.
Appoint a Data Protection Officer. The regulations require one, with contact details published. Smaller companies usually name a manager; the regulator prefers someone based in Oman.
Secure it. Encryption in transit and at rest, access control by role, logs, backups and tested restores. Record what you did: the Ministry can ask.
Plan for breaches. Write a short procedure: who decides, who notifies the Ministry within 72 hours when a breach threatens people's rights, and how affected people are told when serious harm is likely.
Control transfers abroad. Data stored or processed outside Oman needs the person's explicit consent and a destination that protects it to an equivalent standard. List every foreign service in your stack and cover it in the notice and consent.
Review automated decisions. If software decides something about a person without meaningful human involvement, such as refusing a loan or an order, the person has the right to object and get human review. Build that path.
Where websites and apps usually go wrong
| Where | Typical gap | Fix |
|---|---|---|
| Contact and lead forms | No notice, data emailed to a shared inbox and never deleted | Notice link, consent box, CRM with retention rule |
| Ecommerce checkout | Marketing opt-in pre-ticked or merged with order consent | Separate, unticked marketing checkbox; log the choice |
| Analytics and ads pixels | Third-party scripts load before any notice | Load non-essential scripts only after consent |
| WhatsApp and chatbots | Chat history kept forever, bulk messages sent without opt-in | Retention on chat logs, opt-in before broadcasts |
| Mobile apps | Permissions requested for camera, contacts or location without a reason | Ask only when needed, explain why, work without it |
| Admin panels | Every staff member sees every customer record | Role-based access and audit logs |
| Hosting and SaaS tools | Data in foreign regions with no consent or processor terms | Inventory the stack, add processor terms, cover transfers in the notice |
| Accounts | No way to export or delete an account | Self-service export and delete, or a monitored request channel |
Penalties
The law and the amendment carry administrative measures and fines. Administrative measures include warnings, suspension and cancellation of permits. Fines in the original law range from a few hundred rials for failing to inform people before collection, to tens of thousands for sensitive-data breaches, up to hundreds of thousands of rials for unlawful transfers abroad that cause harm. The September 2026 amendment sets fines of up to OMR 2,000 for consent breaches and up to OMR 10,000 for breaches of processing controls and automated-processing rules, according to CMS's summary. Figures vary between published summaries, so read the current Arabic text or ask a lawyer before quoting them in a policy.
The more immediate risk for most businesses is not a fine. It is a complaint from a customer, which can be filed with the Ministry within 30 days of discovering a violation, and the time it takes to answer when you have no record of what you collected.
How OGB Labs builds this in
Every website, online store and app we build in Oman ships with a data map, a privacy notice linked from each form in Arabic and English, separate consent for marketing, consent-gated analytics, role-based admin access, retention rules, and an account export and delete flow. For chatbots and WhatsApp automation we add opt-in and retention on chat logs, as described in our guide to guide to WhatsApp AI chatbots in Oman. We also audit existing sites and apps against this checklist and fix the gaps. See custom software development in Oman, mobile app development in Oman and website development in Oman, or message us on WhatsApp at +968 7111 0727. Your lawyer owns the legal opinion; we own the implementation.
( FAQ )
Questions people ask.
Is Oman's data protection law in force?
Yes. The Personal Data Protection Law (Royal Decree 6/2022) has been fully enforceable since 5 February 2026, when the grace period under the Executive Regulations ended. Royal Decree 68/2026 amended it with effect from 7 September 2026.
Does the PDPL apply to a small business website in Oman?
Yes. The law applies to any processing of personal data of individuals in Oman, by any business, large or small, and since the 2026 amendment whether the processing happens inside or outside Oman.
Do I need a cookie banner in Oman?
The law does not use the word cookie, but it requires notice and consent before processing personal data, and analytics and advertising scripts collect identifiers. The safe pattern is a notice with a real choice, and non-essential scripts that load only after consent.
Can I send WhatsApp or SMS marketing to my customers?
Only with their explicit consent given before the first message, and with an immediate way to opt out. Buying a customer's product does not by itself permit marketing to them.
Does my privacy policy need to be in Arabic?
Yes. Arabic is the official language and the notice should be provided in Arabic before collection. An English version alongside it is good practice for a bilingual site.
Can I host my website or app data outside Oman?
Transfers abroad need the person's explicit consent and a destination with equivalent protection, and sensitive data may need extra approval. Many Omani businesses host abroad lawfully; the work is in the notice, the consent and the processor terms.
What is sensitive data under the Oman PDPL?
Genetic, biometric and health data, ethnic origin, sexual life, political and religious views and criminal records. Processing them needs a permit from the Ministry of Transport, Communications and Information Technology before you start.
How fast must I report a data breach in Oman?
Within 72 hours to the Ministry when the breach threatens people's rights, and to the affected people in the same timeframe when serious harm or high risk is likely.
Do I need a Data Protection Officer?
The Executive Regulations require controllers to appoint one and publish contact details. In a small company this is usually a named manager rather than a new hire.
( Related )
Service · 05
Custom Software
Portals, dashboards and business systems shaped around the way your company really runs.
Service · 01
Websites
Company websites and web platforms designed around your brand, built to rank and to turn visitors into customers.
Service · 03
Mobile Apps
iOS and Android apps people open every day — designed, engineered and shipped to the stores.
Muscat · Oman
Website development company in Oman
Muscat · Oman
Mobile app development company in Oman
Muscat · Oman
Software development company in Oman
Muscat · Oman
WhatsApp automation and AI chatbots for businesses in Oman
Muscat · Oman
AI specialists in Oman: AI agents, automation and custom AI for business
Muscat · Oman
Healthcare and clinic marketing in Oman
Guide · SEO · Arabic
Arabic SEO in Oman: ranking in two languages
Guide · AI search · Marketing
Google AI Overviews and AI Mode in Oman
Guide · Ecommerce · Oman
Oman VAT registration for online sellers
( Next step )
Want this done for you?
Tell us what you are building. We reply within one business day.