Law note · Oman

Personal Data Protection Law, comprehensive regime and scope

cite Royal Decree No. 6/2022, Arts. 3-4, 7 stage IN FORCE in force since 2023-02-13 kind Comprehensive regime binds public and private bodies reviewed 2026-08-29

What it requires

An app that collects, uses, or discloses the personal data of an individual in Oman must treat that processing as covered by the Personal Data Protection Law by default, unless it falls within one of Article 3's enumerated exclusions such as publicly available data collected lawfully.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

What we found

Art. 3 excludes a list of processing activities entirely from the Law's scope: national security and public interest, state administrative functions, legal-obligation compliance, state economic and financial interest protection, vital-interest protection, crime detection or prevention on formal written request, contract performance, personal or family-sphere processing, de-identified research or statistics, and publicly available data (Art. 3(j), see the jurisdiction summary).

Art. 4 sets a general coverage default for anything not excluded: "Personal data is deemed protected by virtue of the provisions of this law." The Ministry of Transport, Communications and Information Technology implements the Law under Art. 7, issuing controls, procedures, licences, and a controller and processor register.

Primary source

official consolidated Royal Decree text, decree.om

← Back to the example · Lint your app →