Do I need a data protection officer under Oman's PDPL?

Yes. Every controller must designate a data protection officer, with no size threshold (Article 20), and publish the officer's name and contact details (Executive Regulation, Article 36). The consent request on a website must also name the controller, the officer's contact and the purposes of processing (Article 10).

A Ministry permit is needed only for sensitive data such as health, genetic or biometric data; there is no general registration. Breaching the DPO duty carries a fine of OMR 1,000 to 5,000 (Article 26).