Oman Personal Data Protection Law (Royal Decree 6/2022) compliance software
Oman's Personal Data Protection Law with its Executive Regulation, transcribed article by article — lawful processing, sensitive data, rights, breach notification and transfers, fully enforceable since 5 February 2026.
- RegulatorMinistry of Transport, Communications and Information Technology (MTCIT)
- InstrumentsRoyal Decree 6/2022 · Executive Regulation MD 34/2024 · fully enforceable from 5 February 2026
- Structure9 duty-based domains, 35 controls, each citing its article
- Time limits45 days for data subject requests · 72 hours for breach notification
What Oman PDPL requires
Who it applies to
- Any controller or processor processing personal data in the Sultanate of Oman
- Organisations processing sensitive personal data or children's data, which need the Ministry's permission
- Organisations transferring personal data outside Oman
- CBO-licensed institutions and telecom operators already assessed against sector frameworks
Oman's Personal Data Protection Law was promulgated by Royal Decree 6/2022. Its Executive Regulation followed under Ministerial Decision 34/2024, issued on 28 January 2024, and the transition period ended on 5 February 2026, from which date the law is fully enforceable. The regulator is the Ministry of Transport, Communications and Information Technology.
The law requires a lawful basis and explicit consent where consent is the basis, clear notice to the individual, procedures for access, correction, erasure and transfer requests, special permission for sensitive data — genetic, biometric, health, ethnic origin, sexual life, political and religious opinions, criminal record — and for children's data, security and confidentiality measures, notification of breaches to the Ministry and to affected individuals, and controls on transferring personal data outside the Sultanate.
GRCLens carries the law as 35 controls in nine duty-based domains, each citing its article in the Decree and, where it applies, the Executive Regulation's time limits — including the 45-day limit for responding to data subject requests and the 72-hour breach notification window.
How GRCLens supports Oman PDPL
Oman PDPL runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Article by article
Scope and lawful processing, sensitive data and children, data subject rights, transparency and notice, controller accountability, security and breach, cross-border transfer, direct marketing and enforcement readiness — each control cites its article.
The Regulation's clocks
Data subject requests are tracked against the 45-day limit and breaches against the 72-hour notification window, with the handling record the Ministry would ask to see.
Registers shared with the security programme
Processing activities, requests and breach records live in the same registers the CBO CS&RF and ISO/IEC 27001 assessments read, so the privacy officer and the security team work from one set of facts.
Arabic and English
Every control, category and guidance note in both languages — the Decree is Arabic, the audit may be either.
Oman PDPL frequently asked questions
Is Oman's PDPL enforceable now?
Yes. The transition period ended on 5 February 2026 and the law is fully enforceable, with its Executive Regulation (Ministerial Decision 34/2024) in effect.
Which categories need the Ministry's permission?
Processing of sensitive personal data — such as genetic, biometric and health data, ethnic origin, sexual life, political or religious opinions and criminal records — and of children's data requires permission from the Ministry under the law and its Regulation.
How quickly must a breach be notified?
The Executive Regulation sets a 72-hour window for notifying the Ministry, and affected individuals must also be informed. GRCLens tracks each breach record against that clock.
One platform, many obligations
Talk to us about Oman PDPL
Security Solution Consultants provides Oman PDPL and privacy advisory alongside the platform, so you can combine tooling with hands-on expertise.