Law note · Oman

Personal Data Protection Law, breach notification

cite Royal Decree No. 6/2022, breach notification provision stage IN FORCE in force since 2023-02-13 kind Breach notification binds public and private bodies reviewed 2026-08-29

What it requires

An app that suffers a breach leading to the destruction, alteration, disclosure, access, or illegal processing of an individual's personal data in Oman must notify the Ministry and the affected Data Subject, following the procedure the Executive Regulations set; this document could not confirm a specific notification timeline at primary source.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

What we found

The Royal Decree requires the Controller, in the event of a personal data breach leading to destruction, alteration, disclosure, access, or illegal processing, to notify the Ministry and the Data Subject of the breach, in accordance with the controls and procedures the Executive Regulations set.

As with cross-border transfer, the duty exists in the Decree itself but its timeline, not stated as a fixed number of hours or days in the primary text read, is deferred to the Executive Regulations (Ministerial Decision 34/2024), not read at primary source in this pass.

Primary source

official consolidated Royal Decree text, decree.om

← Back to the example · Lint your app →