Reference
Oman cybersecurity and data protection frameworks
Who each instrument applies to, which text is current, and where to read it. Start with the table, then open the page for the rules that apply to you.
Which instrument applies to whom
| Instrument | Authority | Applies to | Status |
|---|---|---|---|
| Personal Data Protection Law, Royal Decree 6/2022 | MTCIT | Processing of personal data of natural persons in Oman, whether carried out inside or outside Oman | Amended by Royal Decree 68/2026, in force 7 September 2026 |
| Executive Regulations, Ministerial Decision 34/2024 | MTCIT | Controllers and processors subject to the law | In force 5 February 2024; compliance period ended 5 February 2026 |
| Cyber Security and Resilience Framework, Circular BM 1194 | CBO | Banks, finance and leasing companies, money exchange companies and payment service providers licensed by the Central Bank of Oman | Published by the CBO; to be implemented no later than 31 July 2024 |
Reference pages
Personal Data Protection Law
The law as it stands after Royal Decree 68/2026: scope, consent, rights, transfers and duties.
Read moreExecutive Regulations
Breach notices, rights requests, permits and the data protection officer, and where the regulations lag the amended law.
Read moreCentral Bank of Oman framework
Who the cyber security and resilience framework covers, its control domains, the maturity model and incident reporting to the CBO.
Read moreNational cybersecurity. The Cyber Defence Centre, established by Royal Decree 64/2020, is the national reference for protecting Oman's interests in cyberspace, and the Personal Data Protection Law applies without prejudice to its competences. MTCIT's National Centre for Information Safety (OCERT) publishes security advisories and runs digital trust services and the national cybersecurity industry programme. Report cyber incidents to the Cyber Defence Centre. See who regulates what.
Last verified against official sources: 26 September 2026
Sources
- Royal Decree 6/2022 issuing the Personal Data Protection Law (English translation, decree.om) (opens in a new tab)
- Royal Decree 68/2026 amending the Personal Data Protection Law (English translation, decree.om) (opens in a new tab)
- MTCIT, Executive Regulations of the Personal Data Protection Law (Ministerial Decision 34/2024) (opens in a new tab)
- Central Bank of Oman, Cyber Security and Resilience Framework (CS&RF) (opens in a new tab)
- Cyber Defence Centre (opens in a new tab)
- Oman National CERT (opens in a new tab)
Ten minutes to know exactly where you stand
Tell us what you do and what data you hold. We will show you what the amended Personal Data Protection Law asks of you, where the gaps usually are, and the shortest route to ready. No slides, no pitch.