These jurisdiction checklists are practical scoping aids for privacy, DPO, DSAR, transfer, incident, and vendor governance decisions. Confirm obligations against your facts before relying on any checklist as advice.
Oman Personal DataProtection Law
Royal Decree No. 64/2020
Comprehensive compliance checklist for Oman's Personal Data Protection Law, covering all key provisions, requirements, and best practices for data controllers and processors.
Key Provisions & Compliance Checklist
Key Provisions
Key Definitions (Article 1)
- Personal Data: Any information that can directly or indirectly identify a person
- Genetic Data: Data about inherited or acquired genetic traits
- Biometric Data: Data from technical analysis of physical or behavioural traits
- Health Data: Data about physical, mental, or psychological health
- Controller: Person/organisation deciding why and how data is processed
- Processor: Person/body processing data on behalf of controller
Scope and Application (Articles 2, 3)
The law applies when personal data is being processed.
Exemptions include:
- National security or public interest purposes
- State government departments performing official duties
- Processing to follow legal obligations
- Protection of state's economic/financial interests
- Scientific, literary, or economic research (if anonymised)
- Publicly available data (if lawful use)
Protection of Personal Data (Article 4)
Personal data shall be deemed protected by virtue of the Law.
Processing of Sensitive Personal Data (Article 5)
Processing prohibited unless obtaining a permit from the Ministry for:
- Genetic data, biometric data, health data
- Ethnic origins, sexual life
- Political or religious opinions/beliefs
- Criminal convictions or security measures
Processing of Children's Data (Article 6)
Processing a child's data is prohibited except based on their guardian's consent, unless the processing is in the child's best interest.
Ministry's Responsibilities (Articles 7, 8)
Key responsibilities:
- Making and approving data protection rules
- Issuing guidelines for data processing
- Handling complaints related to data misuse
- Working with international bodies
- Issuing/cancelling compliance licenses
- Maintaining registry of controllers and processors
Enforcement powers:
- Send warnings for non-compliance
- Order correction or deletion of wrongfully handled data
- Stop data processing or transfer if needed
Personal Data Subject's Rights (Articles 10, 11, 12)
Processing requires transparency, honesty, and clear consent.
Data subjects have the right to:
- Withdraw consent at any time
- Request changes, updates, or stop data use
- Get a copy of their personal data
- Move data to another controller (data portability)
- Request deletion of data (unless needed for national archiving)
- Be informed of data breaches or leaks
- File complaints with the Ministry
Controller's Obligations (Articles 13-22)
- Data Protection Rules: Create and follow rules for data processing, identify risks, set up transfer procedures
- Transparency: Inform data subjects with clear details before processing
- Compliance: Follow all Ministry rules and controls
- Auditing: May need to appoint external auditors
- Record Keeping: Keep records of all processing activities
- Breach Notification: Inform Ministry and affected individuals of breaches
- DPO Appointment: Appoint Data Protection Officer if required
- Confidentiality: Protect data confidentiality
- Marketing: Get written consent before sending marketing material
Processor's Obligations (Articles 15-18)
Processors must comply with Ministry's prescribed controls and procedures. They may be required to appoint external auditors and must maintain processing records and cooperate with the Ministry.
Cross-Border Data Transfer (Article 23)
Controllers may transfer personal data outside Oman according to Regulation controls and procedures.
Transfer prohibited if: Data was processed in violation of the Law or if it is likely to harm the data subject.
Penalties (Articles 24-32)
- Fines: 500 to 500,000 Omani Riyals depending on violation
- Repeat Offenses: Fines doubled for repeat violations
- Additional Penalties: Courts may order confiscation of instruments used in the crime
- Administrative Penalties: Ministry may impose fines up to 2,000 Omani Riyals
Compliance Checklist
Lawful Basis for Processing
Legal Requirement: Obtain clear, written consent before processing (Art. 10). Processing without consent is prohibited except as defined by law.
Recommended Practice: Use opt-in forms with clear language. Store consent records securely. Provide proof of consent.
Data Subject Rights
Legal Requirement: Provide rights to access, correction, erasure, etc. (Art. 11).
Recommended Practice: Offer request mechanisms (e.g., portals, forms). Train staff on handling requests.
Security Measures
Legal Requirement: Implement technical and procedural measures to ensure lawful processing (Art. 13).
Recommended Practice: Implement security measures relevant to the data and processing (e.g., access controls).
Transparency & Notification
Legal Requirement: Inform data subjects about processing details (Art. 14).
Recommended Practice: Use clear and comprehensive privacy notices.
Data Accuracy & Retention
Legal Requirement: Data should be accurate, and data subjects have the right to request amendments, updates or deletion (Art. 11). Controller to set controls and procedures (Art. 13).
Recommended Practice: Establish data accuracy procedures and retention schedules.
Cross-Border Data Transfers
Legal Requirement: Transfers permitted per the Regulation (Art. 23).
Recommended Practice: Use data transfer agreements where required. Assess legality of transfer.
Breach Notification
Legal Requirement: Notify the Ministry and data subject in case of a breach (Art. 19).
Recommended Practice: Establish a breach response plan.
Data Transfer Records
Legal Requirement: Maintain records of processing operations (Art. 17).
Recommended Practice: Maintain documentation of processing activities.
Processor Contracts
Legal Requirement: Controller and Processor shall comply with the controls and procedures prescribed by the Ministry (Art. 15).
Recommended Practice: Include necessary data protection clauses in contracts with processors.
Sensitive Data Handling
Legal Requirement: Processing prohibited unless obtaining a permit from the Ministry (Art. 5). Processing a child's data prohibited except based on guardian's consent (Art. 6).
Recommended Practice: Implement enhanced safeguards for sensitive data (e.g., specialized access controls, DPIAs).
Post-Processing Obligations
Legal Requirement: Data subjects have the right to request deletion unless processing is necessary for national archiving (Art. 11).
Recommended Practice: Establish data deletion or anonymization procedures.
Cooperation with Authorities
Legal Requirement: Controllers and Processors must cooperate with the Ministry and provide necessary information (Art. 18). Controller shall appoint a data protection officer (Art. 20).
Recommended Practice: Maintain open communication with the Ministry. Appoint a DPO.
Need Expert Assistance with Oman PDPL Compliance?
Our team of data protection experts can help you navigate Oman's Personal Data Protection Law requirements and ensure full compliance.
Checklist to implementation
Need a fact-specific view?
Data>Nuance can turn this checklist into a scoped action plan for your product, vendor stack, cross-border transfers, DSAR workflow, breach readiness, or DPO operating model.