Personal Data Protection Law, reach over scraped public personal data
Royal Decree No. 6/2022, Art. 3(j)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 9 February 2023.
A personal data rule binding public and private bodies.
As of 6 September 2026.
What it requires
- A scraper collecting the personal data of an individual in Oman from a public page must confirm the data was made public in a manner not contrary to the Personal Data Protection Law before treating it as outside the Law's scope under Art. 3(j); a biometric identifier such as a faceprint or voiceprint derived from publicly posted photographs, video, or audio requires a Ministry permit under Art. 5 regardless of the recording's public availability.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 3(j), as this jurisdiction's privacy record establishes, excludes lawfully publicly available data from the Personal Data Protection Law's scope entirely, but the exclusion is a scope exclusion qualified by a circularity clause ("in a manner not contrary to the provisions of this law") rather than a blanket carve-out for anything visible online.
A scraper collecting personal data of an individual in Oman from a page that is public but was made public in a manner the Law itself would treat as unlawful, or deriving a biometric identifier such as a faceprint or voiceprint from publicly posted photographs, video, or audio, does not benefit from Art. 3(j) and remains subject to the Law's Art. 5 prior-permit requirement for biometric and other sensitive data and its other duties (security, purpose limitation, cross-border transfer, breach notification).
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics