Sensitive data and Ministry permits in Oman

Which data needs a permit

Article 5 prohibits processing the following without a permit from the Ministry:

• genetic data and biometric data;
• health data;
• racial origin;
• sex life;
• political or religious opinions and philosophical beliefs;
• criminal convictions and data relating to security measures.

Health data is now wider

Since 7 September 2026, health data means personal data relating to a person's physical, mental or psychological health condition, or relating to the provision of health care services to them, which reveals their health status. Appointment, referral and billing records that reveal a condition can fall inside it. Clinics, insurers, employers with occupational health data and health technology companies should recheck what they hold.

The permit procedure

The Executive Regulations set the application process. The Ministry decides within 45 days of receiving all the required data and documents, and no answer within that period means the application is rejected. You may appeal to the Minister within 60 days. A permit is valid for up to 5 years. Plan renewals before expiry.

The Article 5 bis route

As an exception to Article 5, a controller may process:

1. the personal data of people working for it, within the framework of its internal operations and in line with the law, disclosing it to third parties only with the written consent of the employee concerned;
2. personal data captured by surveillance devices and cameras used to meet security requirements issued by the competent entities;
3. data in other cases the minister specifies by decision, under controls the regulation will set.

How this route interacts with the permit requirement in practice has not yet been set out in the Executive Regulations. Document the basis you rely on.

How AccuSights helps

We identify which of your processing needs a permit, prepare the supporting material, and set the controls that sensitive data demands. See our services.