OMAN: New Data Protection Law Introduced

Oman has introduced new data protection legislation. Sultani Decree No. 6/2022, known as The Personal Data Protection Law (PDPL), will enter into force on 13 February 2023, when the processing of personal data will be prohibited without written consent from the subject. Before processing, data controllers must inform the subject in writing of their holding of such data; provide contact information; state how the data is processed; and notify them of their rights. 

Data on genetics, ethnicity, sexuality, health, religious or political beliefs, and criminal convictions cannot be processed without prior Ministry of Transport, Communications and Information Technology (MTCIT) permission. Controllers must appoint a data protection officer and establish procedures complying with the PDPL, the executive regulations, and the MTCIT code of conduct. Violators face fines up to OMR500,000 (US$1.3 million). 

Controllers can transfer personal data outside Oman, unless this violates PDPL provisions or will harm the data subject. Exemptions may apply, such as processing for national security or public interest; for protecting state economic interests; falling within the personal or family sphere; or for crime prevention and detection.