No Match Found
Oman does not currently have a standalone data protection law. Whilst Oman’s Constitution (Royal Decree No. 101 of 96) recognises an individual's right to confidentiality in all forms of communication, it does not recognise the right to privacy as a fundamental right beyond this.
In June 2020, the Sultan of Oman, His Majesty Sultan Haitham Bin Tarik, issued Royal Decree No. 64 of 2020 establishing the Cyber Defense Centre. Although very short, the Decree represents one of the latest developments concerning the data protection and cybersecurity landscape in Oman.
Article 1 of the Decree states that a centre by the name of “The Cyber Defense Centre” will be set up and that such centre will report into the Oman Internal Security Service (“ISS”). The Decree is brief and does not go much further than stating that bylaws and decisions necessary for the implementation of such a system will be issued by the Head of the ISS, and that anything contrary to the Decree and the system it implements is hereby repealed.
The Oman Information Technology Authority (“ITA”) announced in 2017 that it was developing a data protection law. However, the law remains a draft without a clear indication of when it will come into force. It was speculated that if approved and signed into law, the law will grant powerful rights to individuals in Oman, enabling them to exercise GDPR-style levels of control over their personal data, for example by giving individuals the right to:
The ITA went as far as to hold public consultation sessions to discuss this draft law and seek feedback from members of the public on its contents, but limited further developments have since occurred.
In July 2020 the State Council held its eighth ordinary session of the first annual sitting for the seventh term where it discussed the ‘Personal Data Protection Draft Law’, noting the importance of the draft law in light of the ongoing technological developments and digital challenges. Hon. Dr. Rashid bin Salim bin Rashid al Badi, Committee Head of the Legal Committee of the Council, stated that the draft law contains 35 articles divided into five chapters as follows:
Despite providing previously unknown detail on the draft law, no reports on the timelines for promulgation of the draft law have been reported.
A limited number of other laws in Oman relate to the use of personal information and cybersecurity, however these are certainly not the equivalent of bespoke data protection laws such as the GDPR.
The Cyber Crime Law (Royal Decree No 12 of 2011) seeks to address a wide array of illegal activities involving a computer device, computer system or network. It considers various acts as cybercrimes and backs violations of such acts with robust penalties in the form of imprisonment and fines.
The Cyber Crime Law also contains limited provisions with respect to personal data protection, including making it an offence to violate the privacy of individuals using technology. It does not however impose any obligations on those who collect personal data.
The Electronic Transactions Law (Royal Decree No. 69 of 2008), which is based largely on the UN Model Laws relating to e-commerce and electronic signatures, contains limited provisions relating to the processing of personal data, it does however include some requirements relating to the obtaining, retention and dissemination of personal data. However, this law only applies to transactions performed between parties who have agreed to perform their transactions electronically and therefore its narrow data protection provisions do not apply to those who collect personal information outside the scope of this law.
Limited data protection and cybersecurity provisions can also be found in a number of sectoral laws across the telecommunications, financial and healthcare industries.
Given the latest developments concerning data protection and cybersecurity in Oman, with the issuance of Royal Decree No. 64 of 2020 establishing the Cyber Defense Centre, and the latest discussions concerning the Personal Data Protection Draft Law, it seems Oman has data protection and cybersecurity firmly on the agenda, and that further development in this area is likely in the coming months.
© 2017 - 2022 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details.