Explicit consent and data subject rights in Oman

What a valid consent request contains

Under Article 10, as replaced, the request must be clear, explicit and understandable, and must include:

• the details of the controller and of the processor, if there is one;
• how to contact the personal data protection officer;
• the objectives and nature of the processing;
• any other information needed to meet the conditions of the law.

The controller must be able to prove the consent. Keep a record of what the person saw, when they agreed and how. Consent is also needed before you use data for a new purpose.

The four cases that need no consent

1. A legal obligation imposed by a law, judgment, order or court decision.
2. Data available to the public in a manner that does not contravene the law.
3. A vital interest of the data subject, when they cannot be contacted.
4. A contract with the data subject that includes evidence the processing complies with the law.

Everything else needs consent. Processing under these four cases is still inside the law, so every other duty applies to it.

Answering rights requests

Requests to exercise the rights in Article 11 are free. Under Article 16 of the Executive Regulations, you must answer within 45 days of receiving the request. The data subject may ask you to stop processing until you decide, and a refusal must give reasons within the same period.

1. Log every request with the date it arrived.
2. Verify the requester's identity in proportion to the request.
3. Find the data across systems and processors.
4. Answer, or refuse with reasons, within 45 days.
5. Keep the record.

Automated decisions

Article 14, as replaced, requires controllers and processors that use automated processing to protect privacy and confidentiality and not to harm the data subject. The data subject may object to a decision that results from automated processing, and the controller or processor must bring in a human to review it, under controls the regulation will set.

In practice: list the decisions your systems make about people, explain them in your consent requests, and set up a route for objections with a named reviewer.

Marketing

Commercial advertising and marketing need the data subject's explicit consent before you send them, under Article 22. Keep consent for marketing separate from consent for the service.

How AccuSights helps

We review your consent requests and contracts against the new Article 10, set up the request log and the 45 days clock, and design the human review route for automated decisions. See our services.