Oman: what the rules require

The policy must identify the controller, the purposes and description of processing, recipients or disclosures, retention, and data subject rights, and be available before or at the time data is collected.

Basis: Saudi PDPL Article 12 (privacy policy before collection); DIFC Law Articles 29 and 30; Oman Executive Regulations (notice before processing, including DPO details); Qatar PDPPL (notice before processing); ADGM and UAE PDPL transparency duties.

How to meet it: Open the policy with the legal name and contact details of the controller, then list purposes, data categories, recipients, retention periods and rights. For Saudi users publish it in Arabic and English and make it available before any data is collected.

Where consent is used, the policy must tell people they can withdraw consent at any time, explain how, and state that withdrawal does not affect earlier lawful processing.

Basis: Saudi PDPL Article 5(2); DIFC Law Articles 12(5) and 32; UAE PDPL consent provisions; Bahrain Resolution No. 48 of 2022 (withdrawal at any time without cost); Qatar PDPPL (right to withdraw approval); Oman PDPL (right to revoke consent).

How to meet it: Add a sentence such as: You can withdraw your consent at any time, free of charge, by [method]; this does not affect processing carried out before withdrawal. Set up an internal procedure to act on requests.

The policy must explain that personal data is processed only with the data subject's express consent, given by a person with full capacity, and that the controller can prove that consent.

Basis: Oman PDPL Article 10 requires express consent and proof of written consent; the Executive Regulations require consent to be clear, not forced, and recorded in writing, electronically or in another set form.

How to meet it: Describe how consent is captured (signed or electronic form) and kept as evidence, and avoid implying that processing can rest on implied consent or legitimate interests.

The policy must explain that individuals can request access to, or a copy or summary of, their personal data and how it is processed, and how to submit that request.

Basis: DPDP Act Section 11; UAE PDPL Articles 13 to 18; DIFC Law Article 33(1) (free, within one month); Saudi PDPL Article 4; Qatar PDPPL (right to review); Oman PDPL (right to obtain a copy); ADGM and Bahrain PDPL access rights.

How to meet it: List access as a named right with the request channel, identity checks and expected response time, for example one month in DIFC and 30 days under Qatar guidelines.

The policy must explain how individuals can ask for inaccurate data to be corrected or updated and for data to be erased, and when erasure may be refused.

Basis: DPDP Act Section 12; DIFC Law Article 33(2); Saudi PDPL Article 4; UAE PDPL Articles 13 to 18; Qatar PDPPL (alter or delete); Oman PDPL (rectify, update, erase, block); ADGM rights to correction and deletion.

How to meet it: Add named sections for correction and erasure, the request method, and the legal grounds for refusing erasure (for example legal retention duties).

The policy must explain that individuals can receive data they provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller where the law allows.

Basis: DIFC Law Article 37; UAE PDPL Articles 13 to 18; ADGM portability right; Saudi PDPL Article 4; Oman PDPL portability right.

How to meet it: Add a portability section that names the export format (for example CSV or JSON) and explains how to request direct transfer to another provider.

The policy must state that children's data is processed only with the consent of a parent or guardian and, in Oman, only for a clear and safe purpose using the minimum data needed.

Basis: Qatar PDPPL requires explicit parental consent and treats children's data as special nature data; Oman PDPL and Executive Regulations require express parental consent and processing in the child's best interest.

How to meet it: Add a children's section that states the age threshold, how parental consent is obtained and checked, and that only the minimum data is collected.

The policy must state how long each category of data is kept, or the criteria used, and that data is deleted or anonymised once no longer needed.

Basis: Saudi PDPL Article 18 (destroy data when no longer necessary); DIFC Law Article 22 (delete, anonymise or archive when the basis ends); Oman PDPL fines retention violations; UAE PDPL, ADGM, Qatar and Bahrain storage limitation duties.

How to meet it: Add a retention table by data category with periods or criteria, plus the method of secure deletion or anonymisation at the end of the period.

The policy must describe the technical and organisational measures used to protect personal data, such as encryption, access control, logging, backups and staff confidentiality.

Basis: DPDP Act Section 8(5) and Rule 6; Saudi PDPL Article 19; Qatar PDPPL Article 13 (cited by NCSA in Binding Decision No. 3 of 2025); DIFC, ADGM, UAE, Bahrain and Oman security obligations.

How to meet it: Add a security section naming the main controls (encryption in transit and at rest, role-based access, logging and monitoring, backups, staff training). Avoid absolute promises such as 100 percent secure.

The policy must commit to notifying the regulator within 72 hours of becoming aware of a qualifying breach (ADGM Commissioner, SDAIA, Qatar NCSA, Bahrain PDPA or Oman MTCIT) and to informing affected individuals.

Basis: ADGM Data Protection Regulations 2021; Saudi PDPL Article 20 and Implementing Regulations (via the National Data Governance Platform); Qatar regulator guidelines and PDPPL Article 14; Bahrain Resolution No. 43 of 2022; Oman Executive Regulations (individuals also within 72 hours where severe harm is likely).

How to meet it: Add a breach clause with a 72-hour regulator deadline, the named regulator for each country, reasons for any delay and notice to affected individuals. For Oman, also tell individuals within 72 hours when severe damage is likely.

The policy must disclose transfers outside Oman and state that they happen only with explicit consent (unless an international agreement applies or data is anonymised) and to recipients giving protection no lower than the PDPL.

Basis: Oman PDPL and Executive Regulations; cross-border violations carry fines of up to OMR 500,000.

How to meet it: Add a transfers section that names destinations, refers to the explicit consent obtained for transfer and confirms the recipient's protection was assessed as equivalent.

The policy must give contact details for the data protection officer where one is required, and Oman requires every controller to appoint one.

Basis: UAE PDPL Articles 10 and 11 (high-risk or large-scale sensitive processing); DIFC Law Articles 16 to 18; ADGM Regulations (exemption for under five employees unless high risk); Saudi PDPL Article 30 and Implementing Regulations (public bodies, large-scale monitoring, sensitive data); Oman Executive Regulations (mandatory, contact details public).

How to meet it: Add a DPO contact block (name or role, email, address). In Oman appoint a DPO in all cases and preferably locate them in Oman.

The policy framework must commit to maintaining a written record of processing activities covering purposes, data categories, recipients, transfers and retention.

Basis: UAE PDPL Articles 7(4) and 8(7); DIFC Law Article 15; ADGM Regulations; Saudi PDPL Article 31 (records kept for five years after processing ends); Qatar regulator guidelines; Oman Executive Regulations.

How to meet it: Add an accountability statement that the company maintains a record of processing activities, reviews it regularly and, for Saudi operations, keeps records for five years after processing ends.

The policy must explain which cookies and trackers are used, their purposes and providers, and how users accept, refuse or withdraw consent for non-essential ones.

Basis: No dedicated cookie law was verified in these jurisdictions (DLA Piper confirms none in Saudi Arabia), so general notice and consent rules apply; Bahrain Resolution No. 48 of 2022 says consent required as a condition of browsing is invalid, and DPDP Section 9(3) bans tracking of children.

How to meet it: Add a cookie section or separate cookie policy listing cookies by category, purpose, provider and duration, with a banner that lets users refuse non-essential cookies as easily as they accept them.

The policy must identify any sensitive data processed, such as health, biometric, genetic, religious, ethnic, criminal or (in Saudi Arabia) credit and location data, and the extra conditions and safeguards applied.

Basis: DIFC Law Article 11; UAE PDPL sensitive data rules; Saudi PDPL Articles 23 and 24 (health and credit data controls) and Article 26 (no marketing use of sensitive data); ADGM policy document duty; Bahrain PDPL Article 5; Qatar and Oman special data rules.

How to meet it: List each sensitive category processed with its purpose, legal condition (often explicit consent) and extra safeguards such as restricted access.

Where sensitive or restricted data is processed, the policy must state that the required regulator permit or prior approval has been obtained.

Basis: Qatar PDPPL (special nature data needs regulator authorisation); Bahrain Resolution No. 44 of 2022 under PDPL Article 15 (biometrics, non-medical genetics, linking data sets, surveillance recording); Oman Executive Regulations (MTCIT permit, 45-day decision, valid five years).

How to meet it: Record the permit or approval reference and validity date for each restricted activity, and state in the policy that such processing happens only under regulator approval.

The policy must state that direct marketing is sent only with prior consent, identifies the sender, and includes an easy way to unsubscribe.

Basis: Saudi PDPL Articles 25 and 26; UAE PDPL (direct marketing requires consent); Qatar PDPPL (approval and sender identity); Oman Executive Regulations (written consent and unsubscribe mechanism).

How to meet it: Add a marketing section stating that you send marketing only with prior consent, that every message identifies the sender and that users can unsubscribe at any time via a link or reply.