In Oman the grace period is over. The Personal Data Protection Law has been fully enforceable since 5 February 2026, and was amended in September 2026 with provisions that touch AI directly. On top of the law sit cloud and banking rules that decide where sensitive data can go. This article summarises what the sources say, and where they differ.

First: the law has been fully enforced since February 2026

The Personal Data Protection Law was issued by Royal Decree No. 6 of 2022, took effect in February 2023, and is overseen by the Ministry of Transport, Communications and Information Technology (MTCIT). Its Executive Regulation was issued by Ministerial Decision No. 34 of 2024, the compliance period was extended to 5 February 2026, and according to CMS the law has been fully enforceable since that date. Processing sensitive data, including health, genetic and biometric data, needs a permit from the ministry (Article 5), and according to Trowers & Hamlins no answer within 45 days counts as a refusal. Breaches are reported to the ministry within 72 hours.

Second: the September 2026 amendment touches AI directly

Royal Decree No. 68 of 2026 was published in the Official Gazette on 6 September 2026 and took effect the next day. According to CMS, the amendment gives individuals a right to object to automated decisions, with human review (Article 14), extends the law to the data of people in Oman even when it is processed abroad (Article 2), and requires data to be deleted as soon as its purpose is met. Any AI system that makes decisions about employees or customers now needs a clear path for a human to step in.

Third: transfers abroad, where the sources do not agree

The law has no general requirement to keep personal data in Oman. But the transfer conditions are read differently: Trowers & Hamlins says Article 23 requires the recipient to give protection no lower than Omani law, without prior ministry approval; Pinsent Masons says the data subject’s express consent is generally required; and CMS adds that sensitive data may need approval from the Cyber Defence Centre. Ask your counsel about your case.

Fourth: cloud and banking need prior approval to leave

This is where location matters. The Telecommunications Regulatory Authority’s cloud computing regulation (September 2024) classifies data into four levels: Level 3 covers regulated sectors such as energy, utilities and insurance, and Level 4 covers state, financial institution and health data. According to SASLO, cloud providers may not move Level 3 or Level 4 data out of Oman without the TRA’s prior approval (Article 12). In banking, the Central Bank of Oman’s Circular BM 1185 (May 2022) points licensed institutions to local cloud providers where feasible, and requires the bank’s prior approval for material arrangements with global providers, including disclosure of where the data is stored (paragraph 7.4).

At the policy level, the ministry launched the Public Policy for the Safe and Ethical Use of AI Systems in May 2025, which applies to government and private bodies and provides for human intervention in sensitive decisions.

When running AI on-premises is the sensible choice in Oman

  1. When you are a bank, a government body, a healthcare provider or in energy. Your data is Level 3 or Level 4, and a foreign cloud means prior approval. Running inside Oman does not.
  2. When your systems read sensitive data. A ministry permit is needed either way, and it is simpler when there is no transfer to justify.
  3. When the system makes decisions about people. The new right to object means you must know what the system decided and why, and a person must be able to review it. That is easier when you hold the logs yourself.
  4. When you operate in more than one Gulf country. One on-premises design works for Oman and its neighbours together.

Where we stand

We will not tell you Omani law bans the cloud, because it does not. But for banks, government bodies and healthcare providers, the shortest route is to keep the data in Oman. Orchestra, our Arabic model, runs inside your data centre or in an in-country private cloud, understands Gulf Arabic, and records every decision and action in a log that cannot be altered, so you can explain and review any decision. For comparison, read about Saudi Arabia, the UAE, Qatar and Kuwait.

This article summarises public sources and is not legal advice. The regulatory picture is moving, so check the official texts and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.