Key Facts
Overview
Oman's PDPL is one of the strictest data protection laws in the Middle East, enacted in 2022 with full enforcement from February 2026. The law mandates written consent with no legitimate interests basis — stricter than GDPR. The tiered penalty structure escalates from OMR 500 for notification failures to OMR 500,000 for unlawful cross-border data transfers, the highest single penalty under the law.
What This Means for Your Website
- Written consent is mandatory before processing personal data of Omani visitors
- There is no legitimate interests basis — consent or another explicit lawful basis is required
- Standard implied consent or browsing-based consent mechanisms are insufficient
- Cross-border data transfers face strict controls with the highest penalties (OMR 500,000)
- Data subjects can revoke consent and request modification or deletion
- DPO appointment is required for certain processing activities
Key Requirements
MTCIT enforces the law with a tiered penalty structure: OMR 500-2,000 for notification failures, OMR 1,000-5,000 for processing violations, OMR 15,000-20,000 for sensitive data and children's data violations, and up to OMR 500,000 for unlawful cross-border transfers. The absence of a legitimate interests basis means consent is the primary lawful mechanism for most website data processing.
How ConsentStack Handles This
ConsentStack applies strict opt-in consent collection for Omani visitors, supporting the written consent requirement and ensuring no data processing occurs without explicit authorization.
Penalties
OMR 500-2,000 (notification failures). OMR 1,000-5,000 (processing violations). OMR 15,000-20,000 (sensitive data/children/breach response). Up to OMR 500,000 (unlawful cross-border transfers).
Key Requirements
- Written consent mandatory before processing personal data
- NO legitimate interests basis for processing (stricter than GDPR)
- Data subjects have rights to revoke consent, request modification, and deletion
- DPO appointment required for certain processing activities
- Data breach notification required
- Cross-border transfers subject to strict controls
Notable Provisions
- STRICT consent model: NO legitimate interests, written consent mandatory
- Tiered penalties escalating by violation severity
- OMR 500,000 for unlawful cross-border transfers (highest single penalty)
- Full enforcement from February 2026 after extended transition period
Other Middle East & North Africa Regulations
Frequently Asked Questions
Why is Oman's consent model stricter than GDPR?
Oman's PDPL has no legitimate interests basis for processing and requires written consent — GDPR allows legitimate interest as a lawful basis without explicit consent.
What is the highest penalty under the Oman PDPL?
OMR 500,000 for unlawful cross-border data transfers, reflecting the law's strict stance on international data flows.
When does full enforcement begin?
Full enforcement began in February 2026, after an extended transition period from the law's enactment in February 2022.
Stay compliant with Oman PDPL
ConsentStack helps you implement Opt-in consent for Sultanate of Oman automatically.