What Is Personal Data Protection Law (Royal Decree No. 6/2022)?
Oman's Personal Data Protection Law was issued by Royal Decree No. 6/2022 on 9 February 2022, published in Official Gazette issue 1429 (13 February 2022), and came into force one year after issuance. It repeals Chapter 7 of the Electronic Transactions Law. The Executive Regulation (Ministerial Decision No. 34/2024, issued 4 February 2024) implements processing permits, children's-data rules, and rights procedures; Ministerial Decision No. 6/2025 later replaced the compliance-period text with a period of no more than two years from the regulation's effective date. Royal Decree No. 68/2026, published by MTCIT on 6 September 2026, amends the Law's scope and exemptions and adds or clarifies exceptions to processing permits and explicit consent, including rules for automated processing. The 2026 decree is treated as an amendment to the 2022 Law, not as a replacement statute. Article 11 gives data subjects the right to revoke consent, request amendment/update/blocking, obtain a copy of processed data, transfer data to another controller, request erasure (unless processing is necessary for national archiving/documentation), and be notified of a breach. Article 12 provides a right to complain to the Ministry. MTCIT's published complaint procedure requires filing within 30 days of certain knowledge of the violation, gives the controller 14 days to respond, and requires the Ministry to decide within 60 days. This is a source-backed evidence profile. The source set mixes official Arabic and English materials; no source located this pass states a controlling-language rule. State administrative units and other public legal persons are exempt from the Law's scope under a separate 2024 circular-based policy.
At a glance
- Full name
- Personal Data Protection Law (Royal Decree No. 6/2022)
- Short code
- Oman PDPL
- Jurisdiction
- Oman
- Enacted
- 2022
- Last major update
- Executive Regulation issued by Ministerial Decision No. 34/2024 (4 February 2024); compliance-period text amended by Ministerial Decision No. 6/2025; Royal Decree No. 68/2026, published 6 September 2026, further amended scope, exemptions, permit and consent exceptions, and automated-processing rules
- Regulator
- Ministry of Transport, Communications and Information Technology (MTCIT), Personal Data Protection Department
- Private right of action
- Limited
- Statutory citation
- Royal Decree No. 6/2022 promulgating the Personal Data Protection Law
Scope, who Oman PDPL covers
Protected data
Data subject rights
Revoke previously given consent
Request amendment, update, or blocking of data
Obtain a copy of processed personal data
Transfer personal data to another controller (portability)
Request erasure, unless processing is necessary for national archiving and documentation (Article 11)
Be notified of a data breach or infringement and the actions taken
Complain to the Ministry where processing is non-compliant (Article 12)
Notable features
A secondary legal summary (not the official regulation text) states a 45-day controller-response window for Article 11 rights requests; this should be confirmed against the official Arabic Executive Regulation before being treated as authoritative. MTCIT separately publishes PDPC@mtcit.gov.om for violation reports.
Enforcement & penalties
Penalties: The reviewed official Gazette text and MTCIT guidance for this research pass focused on rights and the complaint procedure rather than a consolidated administrative-fine schedule; verify current sanction amounts against the Arabic Gazette text before publication.
Private right of action: Article 12 provides a complaint route to the Ministry rather than a described standalone civil-damages action; the Ministry’s published procedure gives it 60 days to study and decide a complaint, with no response treated as rejection.
Relevance to data brokers
No Oman-specific data-broker registry, public-record suppression program, or broker-specific removal route was located. The actionable general route is a written rights request to the controller, followed by the MTCIT complaint route where a violation is alleged.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
When did Oman’s Personal Data Protection Law come into force?+
Royal Decree No. 6/2022 was issued 9 February 2022 and, per its own terms, came into force one year after issuance.
Was Oman’s Personal Data Protection Law amended in 2026?+
Yes. MTCIT published Royal Decree No. 68/2026 on 6 September 2026. It amends the Law’s scope and exemptions and addresses permit, explicit-consent, and automated-processing rules; it does not replace Royal Decree No. 6/2022.
How do I file a complaint under Oman’s data-protection law?+
MTCIT’s published procedure requires filing a complaint/report form within 30 days of certain knowledge of the violation; the controller gets 14 days to respond, and the Ministry decides within 60 days, treating no response as rejection.
Official sources & citations
Other international privacy regimes
Oman PDPL sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: