On January 28, 2024, the Ministry of Transport, Communications, and Information Technology (MTCIT) published Ministerial Resolution No. 2024/34 issuing the executive regulations for the Personal Data Protection Law (the Law). The regulations outline the data protection obligations of controllers and processors under the Law.

Requirements for processors and controllers

Specifically, the regulations provide that controllers must:

• obtain express consent from data subjects before processing their data and in the case of a child, the express consent of the child's guardian;
• obtain a permit from the MTCIT before processing any personal data;
• obtain express consent from data subjects before transferring their personal data outside Oman;
• respond to data subject rights requests within 45 days from the date of receipt of the request;
• obtain consent before sending any advertising, marketing, or commercial material to data subjects; and
• notify the competent department within 72 hours from the discovery of a breach if it would lead to a threat to the rights of data subjects.

With regards to penalties, the regulations provide that anyone who violates its provisions may:

• receive a warning;
• have their permit suspended or canceled; or
• receive an administrative fine of up to OMR 2,000 (approx. $5,195) for each violation.

You can read the press release here and the regulations here, both only available in Arabic.