My company works in Oman. What does the law ask of us when an AI agent reads our data?

The law that applies

The Personal Data Protection Law was issued by Royal Decree 6/2022. Its Executive Regulations were issued by Ministerial Decision 34/2024. The ministry dates them 4 February 2024. The Ministry of Transport, Communications and Information Technology enforces both, through its Personal Data Protection Department. The department receives complaints and breach reports, and decides on permits.

Royal Decree 68/2026 of 3 September 2026 amended the law. It took effect on the day after its publication in the Official Gazette. The law now applies to the personal data of natural persons in Oman, whether the processing takes place inside or outside Oman. So a foreign model provider that processes your clients’ data is within its reach.

The amended law does not apply to some processing, among them processing for national security or the public interest, and processing by state administrative units and other public legal persons within their legal powers. It also excludes processing by a person in a personal or family setting that is not published. Government units follow a separate personal data protection policy, Circular 6/2024.

Can the agent read personal data at all?

The default rule is strict. Personal data may not be processed, or its purpose changed, except with transparency, honesty and respect for human dignity, and after the person’s explicit consent. You must be able to prove that consent. The request for consent must be written, clear and explicit. It must name you and your processor, give the contact details of your data protection officer, and state the purposes and nature of the processing.

The 2026 amendments allow processing without explicit consent in four cases:

• A legal obligation placed on you by a law, a judgment, an order or a court decision.
• Data made available to the public, as long as the processing does not break the law.
• A vital interest of the person, where you cannot reach them.
• A contract the person is party to, provided the contract states that the data will be processed under this law.

Three more rules matter for an agent:

• Decisions made by automated processing. The 2026 amendments rewrote this article. In all cases, a person may object to decisions that result from automated processing. You or your processor must then bring in a human when reviewing the decision objected to, under the controls set out in the regulations. When you use automated processing, you must also take suitable measures to protect the privacy and confidentiality of the data and to avoid harming the person.
• A permit for sensitive data. Genetic, biometric and health data, racial origin, sexual life, political or religious opinions or beliefs, criminal convictions and data on security measures need a permit from the ministry before you process them. The 2026 amendments exempt some cases, among them your own employees’ data within your internal work organization.
• Delete when the purpose ends. You and your processor must erase the data once the purpose of processing ends, unless there is a dispute or a legal obligation to keep it.

The model provider, and data sent abroad

You may contract another entity, a processor, to process personal data on your behalf. The ministry explains that, towards third parties, the processor acts as your agent for civil and administrative liability. A model provider that runs your agent’s model is your processor.

Before you send personal data outside Oman, the regulations require three things:

• Explicit consent. You need the person’s explicit consent, and the transfer must not harm national security or the higher interests of the state. Consent is not needed where the transfer fulfils an international obligation under a treaty Oman has joined, or where the data is anonymized so the person cannot be identified in any way.
• Adequate protection. You must make sure the foreign processor gives protection no lower than Omani law and the regulations.
• A written assessment. You must assess the protection at the destination and the risks of the transfer, including the nature and volume of the data, the purpose, the duration, and the countries the data will pass through. The ministry may ask for a copy.

For sensitive data there is one more step. The ministry says approval from the Cyber Defence Centre is required if sensitive personal data will be stored or processed outside Oman.

When something goes wrong

You must notify the ministry’s competent department within 72 hours of learning of a breach, if the breach may lead to a risk to the rights of the people whose data it affects. You must also notify the affected person within 72 hours if the breach may cause them serious harm or high risk. You must document every breach in your processing record.

The 2026 amendments set fines for two rules that matter here. Breaking the consent rule can bring a fine of 500 to 2,000 Omani rials. Breaking the rules in Articles 13 and 14, which include the article on automated processing, can bring a fine of 5,000 to 10,000 Omani rials.

What Oman says about AI itself

The ministry runs the National Program for Artificial Intelligence and Advanced Digital Technologies. One of its three axes is the governance of AI applications, including legal and regulatory frameworks for safe and ethical use and data privacy. On 1 April 2025 the ministry published the General Policy for the Safe and Ethical Use of Artificial Intelligence Systems. It is a policy, not a law. I found no Omani law that regulates AI as such, as of October 2026. For an agent that handles personal data, the binding rules are the data protection law and its regulations.

What this means for you

• Get explicit consent, in writing and in clear words, unless one of the four exceptions truly fits your case.
• If the agent decides anything about a person, build a way for a human to review the decision when the person objects.
• Check whether the agent reads sensitive data. If it does, you may need a ministry permit, and Cyber Defence Centre approval if the model runs outside Oman.
• Write the transfer assessment before the agent sends personal data to a provider abroad.

I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.

References

1. MTCIT, Royal Decree 68/2026 Amending Some Provisions of the Personal Data Protection Law
2. MTCIT, Executive Regulations of the Personal Data Protection Law
3. MTCIT, Personal Data Protection: overview, forms and FAQ
4. MTCIT, General Policy for the Safe and Ethical Use of Artificial Intelligence Systems, April 2025
5. MTCIT, National Program for Artificial Intelligence and Advanced Digital Technologies

Hesham Elmahdy, Published 28 October 2026