Saturday 24 / January / 2026
In an increasingly digital environment, safeguarding personal information has become a legal necessity. Oman’s Personal Data Protection Law, promulgated under Royal Decree 6/2022, establishes a structured framework regulating the processing of personal data and setting clear rules for its protection.
Speaking exclusively to the Times of Oman, Dr. Mohammed Ibrahim Al Zadjali, Founding Partner of Mohammed Ibrahim Law Firm, a leading law office in Oman, explained that “the law governs how personal data relating to individuals may be collected, used, stored, disclosed, and transferred, and applies to any activity that involves the processing of such data, subject to specific exemptions outlined in the law.”
He added that “its subject focuses on protecting personal data that identifies an individual, while its scope extends to all forms of processing carried out by controllers and processors, in accordance with the provisions of the law. In simple terms, a “controller” is the person who decides why and how to process personal data, while a “processor” is the person who processes data on the controller's instructions.”
He further stated that “The law requires explicit consent from the data subject prior to processing and grants them specific rights, including the right to withdraw consent, request amendment, update, or blocking of personal data, obtain a copy of processed data, transfer personal data to another controller, request the erasure of personal data in accordance with the law, and be notified of personal data breaches or infringements as prescribed.”
“The law imposes defined obligations on both controllers and processors, including obtaining explicit consent, implementing technical and organisational protection measures, appointing a personal data protection officer, maintaining processing records, and complying with statutory breach notification requirements, in accordance with the provisions of the law and its Executive Regulation,” he said.
He also explained that “certain categories of personal data, such as genetic, biometric, and health data, as well as data relating to racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or security measures, are subject to enhanced safeguards and may only be processed after obtaining the necessary permit from the Ministry, in accordance with the Executive Regulation.”
“Oman’s Personal Data Protection Law provides a clear legal structure that regulates personal data processing and strengthens the protection of individual privacy,” he concluded.
(Mohammed Ibrahim Law Firm ([email protected]), (+968 244 87 600) was established on 14th December 2006 and is serving clients through its offices in Muscat and Sohar, as well as operating on a request basis in other areas. It offers legal representation across a wide range of practice areas that include Labour Law, Corporate, Commercial, Contracts, Banking and Finance, International Trade, Foreign Investment, Insurance, Maritime Law, Construction and Engineering Contracts, International Arbitration, Intellectual Property and more).
