Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

Extracts :

Extract :

"8.1. Right to be informed Prior to commencing processing, the controller must provide the data subject with certain information, such as: • the main details of the controller and processor; • the contact details of the DPO; • the purpose of processing personal data and the source from which it was collected; • the rights of data subjects; • the recipients of the personal data, and a description of the processing and the procedures in place; and • any other information that may be necessary to fulfill the processing conditions. Controllers may meet this requirement by having a compliant privacy policy or notice, and subsequently obtaining the data subject's consent through a click and accept procedure. A violation of this provision of the Oman PDPL is punishable by a fine no less than OMR 500 (approx. €1,207) and not exceeding OMR 2,000 (approx. €4,830). 8.2. Right to access Article 11 of the Oman PDPL provides for a data subject's right to access personal data. 8.3. Right to rectification Article 11 of the Oman PDPL provides for a data subject's right to rectification, update, or blocking of their personal data. 8.4. Right to erasure Article 11 of the Oman PDPL provides for a data subject's right to erasure of their personal data unless processing is necessary for the purpose of preservation or national documentation. 8.5. Right to object/opt-out Not applicable. 8.6. Right to data portability Article 11 of the Oman PDPL provides for a data subject's right to data portability. 8.7. Right not to be subject to automated decision-making Not applicable. 8.8. Other rights Furthermore, data subjects have the right to submit a complaint to the Ministry if they see or consider that the processing of their personal data is not in compliance with the Oman PDPL, in accordance with the controls and procedures determined by the Executive Regulations. Additionally, Article 11 of the Oman PDPL provides for a data subject's right to revoke consent (without prejudice to any processing which took place prior to such withdrawal). Data subjects also have the right to be informed in the event of a personal data security breach that causes their personal data to be destroyed, altered, disclosed, accessed, or otherwise processed unlawfully as per Article 19 of the Oman PDPL."

Reference :

Oman Data protection overview | DataGuidance

Information on Oman data protection

🇴🇲 Oman

Data subject classification

Citizens outside their jurisdiction are considered as data subjects :

Persons within their jurisdiction are considered as data subjects :

Legal entities are considered as data subjects :

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Differentiation between how data controller and data processor are defined : Yes

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : No

Definition of personal data that are "special" or "sensitive": genetic data : No

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": medical/health data : No

Definition of personal data that are "special" or "sensitive": criminal records data : No

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : No

Definition of personal data that are "special" or "sensitive": political opinions : No

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : No

Definition of personal data that are "special" or "sensitive": trade union membership : No

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject :

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : No

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : No

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : No

Potential legal bases for processing personal data: the personal data is necessary for a public interest : No

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : No

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) :

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : Yes

Subject private remedies - presence of individual personal actions? : No

Subject private remedies - representative actions? : No

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Audit or supervise Data Processors :

Requirement of a DPIA : No

Ensuring encryption/pseudonymisation as a security control : No

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : No

Rights of data subjects

Right to object data use or/opt out : No

Right to data portability : Yes

Right against automated decision making : No

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : No

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : No

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : No

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : Yes

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing :

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : No