Oman's Personal Data Protection Law (Royal Decree 6/2022): what it means for websites
Oman's data protection law has applied since February 2023, its two-year grace period ended on 5 February 2026, and an amendment in force since 7 September 2026 now reaches processing outside Oman and requires explicit consent. The law does not mention cookies, but it lists electronic identifiers as personal data, so a website's analytics and advertising tags need the visitor's explicit opt-in before they run.
Feb 2026
End of the grace period
Sep 2026
Amendment in force (Royal Decree 68/2026)
72 hours
To report a breach to the Ministry
The short answer
Does Oman require cookie consent?
No Omani law or regulation mentions cookies. But the Personal Data Protection Law lists electronic identifiers as personal data and, since its September 2026 amendment, requires explicit consent the controller can prove, unless one of a short list of exceptions applies. Analytics and advertising cookies fit none of those exceptions, so in our reading they need the visitor's opt-in before they run.
This is an interpretation of the law's definitions, not Ministry guidance: the Ministry has published nothing on cookies. Two further points matter for a website. The law now applies to people in Oman even when the site is run from abroad, and sending identifiers to analytics or advertising servers outside Oman is a transfer that needs consent and a risk assessment.
Royal Decree No. 68/2026 amending the law (Arabic text, qanoon.om)What the law is
Royal Decree No. 6/2022 issued Oman's Personal Data Protection Law on 9 February 2022; it was published in the Official Gazette on 13 February 2022 and came into force a year later, on 13 February 2023.
Its Executive Regulation, Ministerial Decision No. 34/2024, took effect on 5 February 2024, and Ministerial Decision No. 6/2025 extended the adjustment period to two years, so full compliance has been due since 5 February 2026. Royal Decree No. 68/2026 then amended the law, in force since 7 September 2026: the law now applies to the personal data of people in Oman whether the processing happens inside or outside the country, consent must be explicit rather than written, and a new article lists the only cases where processing needs no consent.
There is no legitimate-interest basis. The regulator is the Ministry of Transport, Communications and Information Technology, acting without prejudice to the powers of the Cyber Defence Centre; Oman has no separate data protection authority.
Many published summaries predate the September 2026 amendment, so check the date of anything you rely on.
What the law requires of a website
- 01
Explicit consent before tracking
Processing needs the data subject's explicit consent, which the controller must be able to prove, unless one of the grounds in the new Article 10 bis applies (Article 10, as amended). The law's definition of personal data lists electronic identifiers (Article 1), so cookie and advertising identifiers are covered. No Omani text mentions cookies; this is our reading of the definitions, and no Ministry guidance on cookies exists.
- 02
A clear consent request, in any form you can prove
The consent request must be written in a clear, explicit and understandable form and name the controller, the DPO contact and the purposes (Article 10). The Executive Regulation accepts consent given in writing, electronically or by other means the controller sets (Article 4), so a recorded click on a banner is a permitted form.
- 03
A data protection officer, published
Every controller must designate a data protection officer, with no size threshold (Article 20), and publish the officer's name and contact details (Executive Regulation, Article 36).
- 04
Marketing only with explicit consent
Advertising or marketing sent for commercial purposes needs explicit consent first (Article 22, as amended), with an opt-out that stops the messages free of charge. The Executive Regulation, not yet updated, still says written consent for marketing.
- 05
Transfers abroad need consent and an assessment
Transferring data outside Oman needs the data subject's explicit consent, a recipient whose protection is not lower than Oman's, and a transfer risk assessment (Executive Regulation, Articles 37 to 39). Analytics and advertising platforms hosted abroad are the usual case for a website.
- 06
Breaches, privacy policy and permits
Report a breach to the Ministry within 72 hours where it risks people's rights, and tell those people within 72 hours where the harm may be serious (Executive Regulation, Articles 30 and 32). Publish a privacy policy in a visible place before processing (Executive Regulation, Article 21). A Ministry permit is needed only for sensitive data such as health, genetic or biometric data (Article 5).
Penalties
The fines in Articles 25 to 30 are imposed by the courts. Separately, the Ministry can issue warnings, suspend or cancel a permit, and impose an administrative fine of up to OMR 2,000 per violation (Article 32; Executive Regulation, Article 44).
- 01
Consent breaches
OMR 500 to 2,000 for breaching the explicit-consent rules in Article 10 (Article 25, as amended). Breaching the DPO or marketing-consent duties carries OMR 1,000 to 5,000 (Article 26).
- 02
Breach notification and sensitive data
OMR 15,000 to 20,000 for failing to notify a breach, processing sensitive data without a permit, or breaching the rules on children's data (Article 28).
- 03
Transfers abroad
OMR 100,000 to 500,000 for breaching the cross-border transfer rules (Article 29). This is the law's highest band, and it applies to transfers only, not to every violation.
- 04
Companies
Where an offence is committed in a legal person's name or for its account, the company faces OMR 5,000 to 100,000 (Article 30).
What Arqam360 does for a website with visitors in Oman
- 01
Opt-in before tags run
By default the banner asks every visitor before analytics and advertising tags run, and Google tags stay denied through Consent Mode v2 until the visitor chooses. With regime detection switched on, visitors in Oman get the opt-in model with Arabic as the banner's default language.
- 02
Consent you can prove
The law puts the burden of proof on the controller. Each choice, including a later change, is stored with its date, time and the categories accepted or refused, and can be exported as a CSV file.
- 03
Arabic first, and English
A native right-to-left Arabic banner with an English version, a free privacy policy generator that lists Oman, and a cookie policy template in both languages.
- 04
Holding tags that ignore Consent Mode
For the Meta Pixel, TikTok and other tags that do not read Consent Mode, an optional setting holds the script until consent. It is off by default, because blocking scripts can break a site, so switch it on and then check your pages.
Timeline
Law issued
Royal Decree No. 6/2022 issued on 9 February and published in the Official Gazette on 13 February 2022.
Law in force
In force from 13 February 2023, one year after publication.
Executive Regulation
Ministerial Decision No. 34/2024 in force from 5 February 2024, with a one-year adjustment period.
Grace period ends
Ministerial Decision No. 6/2025 extended the adjustment period to two years, ending on 5 February 2026.
Law amended
Royal Decree No. 68/2026 in force from 7 September 2026: reach outside Oman, explicit consent, new grounds without consent, revised fines.
Check what your site does before consent
The free scanner loads your site in a real browser and lists the cookies and trackers that run before a visitor chooses. It is the part of compliance anyone can check from outside.
Scan your siteDone for you
We set it up on your website
We install the consent banner, wire Google Consent Mode v2, test your Google and Meta tags, and publish your bilingual privacy policy. $299 to install, then $99.99 a month per domain.
Regulations
Compliance guides for GDPR, PDPL, and more
regulations.omanPdpl.faq.title
regulations.omanPdpl.faq.subtitle
Yes, since 7 September 2026. The amended Article 2 applies the law to the personal data of people in Oman whether the processing happens inside or outside the country, so a foreign website that collects data from visitors in Oman is within scope.
Put an Arabic consent banner on your site
The banner takes minutes on WordPress, Shopify, Zid or any custom site. The officer, transfer assessment and records are yours to arrange; the banner is the part your visitors see first. Start free, or let our team install it and test your tags.