The framework
Oman's framework rests on the Personal Data Protection Law (Royal Decree 6/2022), with the Ministry of Transport, Communications and IT as the supervisory authority.
That puts Oman in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Personal Data Protection Law (Royal Decree 6/2022)
In force since February 2023 with 2024 executive regulations, Oman's law is notable for demanding express consent as the default and permits for sensitive-data processing, a compliance posture stricter than the GDPR's on paper.
Marketing and advertising
Express written-form consent is the default basis, one of the strictest consent standards anywhere; sensitive data needs ministry permits. That single sentence decides most channel plans here.
Cross-border transfers
Permitted subject to conditions in the executive regulations (2024).
Enforcement and penalties
Fines reach OMR 500,000. Read the ceiling together with the authority's track record, which prices the risk.