In brief
Oman has significantly amended its Personal Data Protection Law (PDPL) through Royal Decree No. 68/2026, marking the most substantial update to the country’s privacy framework since the law was enacted in 2022. The amendments took effect on 7 September 2026 and introduce a number of changes that will be particularly relevant for international businesses processing personal data relating to individuals in Oman.
The reforms expand the territorial scope of the law, introduce new circumstances in which personal data may be processed without obtaining explicit consent, establish a framework for automated processing and automated decision-making, and create additional flexibility for certain employment- and security-related processing activities.
The changes bring several aspects of the Omani regime closer to international privacy standards, including concepts familiar under the EU General Data Protection Regulation (GDPR). However, Oman retains a number of unique features, particularly in relation to sensitive data, government oversight and cross-border transfers.
For multinational organisations operating regional or global processing models, the amendments may significantly broaden the number of activities that fall within scope of the Omani privacy regime.
Download the full alert of Oman: Strengthening Its Data Protection Regime