Oman: Sultanate issues new data protection law
The Ministry of Information ('MoI') announced, on 9 February 2022, that Royal Decree No. 6 of 2022 Promulgating the Law on the Protection of Personal Data ('the Data Protection Law') had been issued by HRH Sultan Haytham, and published in the Official Gazette No. 1429 on 13 February 2022. In particular, the Data Protection Law consists of 32 articles which, among other things, introduce data protection principles that bring the country's legislative regime into closer alignment with global data protection laws. More specifically, the Data Protection Law provides that the Minister of Transport, Communications and Information Technology shall issue executive regulations to supplement the Data Protection Law as well as the necessary decisions to execute its provisions and ensure compliance with the same. In this regard, the Data Protection Law also designates the Ministry of Transport, Communications and Information Technology as the regulatory authority responsible for giving effect to, and enforcement of, the provisions of the Data Protection Law.
Additionally, the Data Protection Law repeals and replaces Chapter 7 of the Electronic Transactions Law promulgated by Royal Decree No. 69 of 2008, and provides for data subject rights, including the following:
- right to rectification, update, or blocking of personal data;
- right to access personal data;
- right to data portability;
- right to erasure;
- right not to be subject to processing without consent; and
- right to be informed of any breach to their personal data and mitigating measures taken in this regard.
Moreover, with regards to penalties under the Data Protection Law, organisations and natural persons may be subject to fines ranging from a minimum of OMR 500 (approx. €1,140) to a maximum of OMR 500,000 (approx. €1.14 million).
Notably, the Data Protection Law shall come into force a year from its date of publication in the Official Gazette, i.e. 13 February 2023.