Personal Data Protection Law — articles 1–32

For the purposes of this Law, the following words and expressions have the meanings assigned to them, unless the context requires otherwise: Ministry: Ministry of Transport, Communications and Information Technology. Min…

This Law applies to Personal Data that is processed.

This Law does not apply to Processing Personal Data in the following cases: (a) protecting national security or the public interest; (b) performance by units of the State Administrative Apparatus and other public legal p…

Personal Data is protected under this Law.

Processing Personal Data relating to Genetic Data, Biometric Data, Health Data, racial origin, sex life, political or religious opinions, beliefs, criminal convictions or security measures is prohibited unless a permit h…

Processing a child's Personal Data is prohibited without the approval of the child's guardian, unless the Processing is in the child's best interests, in accordance with the controls and procedures prescribed by the Regu…

Without prejudice to the powers assigned to the Cyber Defence Centre, the Ministry is responsible for implementing this Law and, in particular, shall: (a) prepare and approve controls and procedures for protecting Person…

To protect the rights of Data Subjects, the Ministry may take any of the following measures: (a) warn a Controller or Processor of a violation of this Law; (b) order rectification and erasure of Personal Data processed i…

Ministry employees designated by a decision of the competent authority in agreement with the Minister have judicial enforcement status for the implementation of this Law, the Regulation and decisions issued under it.

Personal Data may be processed only transparently, fairly and with respect for human dignity, and after the Data Subject has given explicit consent. A request to process Personal Data must be written, clear, explicit and…

The Data Subject has the right to: (a) withdraw consent to Processing, without affecting Processing carried out before withdrawal; (b) request amendment, updating or blocking of Personal Data; (c) obtain a copy of proces…

A Data Subject may submit a complaint to the Ministry if the Data Subject believes that the Processing of his or her Personal Data does not comply with this Law, in accordance with the controls and procedures prescribed …

The Controller must establish controls and procedures to be followed when Processing Personal Data. They must include in particular: (a) identification of risks to which the Data Subject may be exposed as a result of Pro…

Before Processing any Personal Data, the Controller must notify the Data Subject in writing of: (a) the details of the Controller and Processor; (b) contact details of the Personal Data protection officer; (c) the purpos…

The Controller and Processor must comply with the controls and procedures prescribed by the Ministry to ensure that Processing is carried out in accordance with this Law.

At the Ministry's request, the Controller and Processor must appoint an external auditor to verify that Processing has been conducted in accordance with this Law and with the Controller's procedures and controls under Ar…

The Controller and Processor must retain documentation of Processing operations for the periods and in accordance with the procedures prescribed by the Regulation.

The Controller and Processor must cooperate with the Ministry and provide the data and documents it requests and considers necessary for exercising its powers under this Law, within the period prescribed by the Regulatio…

Where a Personal Data breach results in unlawful destruction, alteration, disclosure, access or Processing, the Controller must notify the Ministry and the Data Subject of the breach in accordance with the controls and p…

The Controller must designate a Personal Data protection officer. The Regulation prescribes the criteria for selecting the officer and the officer's duties.

The Controller must ensure the confidentiality of Personal Data and must not publish it without the Data Subject's prior consent, as prescribed by the Regulation.

Before sending advertising or marketing material for commercial purposes, the Controller must obtain the Data Subject's written consent, as prescribed by the Regulation.

Without prejudice to the powers assigned to the Cyber Defence Centre, a Controller may transport Personal Data and permit its transfer outside the Sultanate of Oman in accordance with the controls and procedures prescrib…

Without prejudice to any more severe penalty prescribed by the Penal Law or any other law, the offences specified in this Law are punishable by the penalties provided in it.

A person who violates Article 14 is punishable by a fine of not less than OMR 500 and not more than OMR 2,000.

A person who violates Articles 15, 16, 17, 18, 20 or 22 is punishable by a fine of not less than OMR 1,000 and not more than OMR 5,000.

A person who violates Article 13 is punishable by a fine of not less than OMR 5,000 and not more than OMR 10,000.

A person who violates Articles 5, 6, 19 or 21 is punishable by a fine of not less than OMR 15,000 and not more than OMR 20,000.

A person who violates Article 23 is punishable by a fine of not less than OMR 100,000 and not more than OMR 500,000.

Without prejudice to the criminal liability of natural persons, a legal person is punishable by a fine of not less than OMR 5,000 and not more than OMR 100,000 where an offence is committed in its name or for its account…

In addition to a fine, the competent court may order confiscation of the instruments used to commit an offence under this Law.

Without prejudice to the penalties prescribed by this Law, the Ministry may impose administrative sanctions for violations of this Law, the Regulation or decisions issued under it, provided that an administrative fine do…