Pursuant to Royal Decree 6/2022 promulgating the Personal Data Protection Law (PDPL), Oman's first dedicated data protection law which we considered in our previous article "New Oman Personal Data Protection Law", the Minister of Transport, Communications and Information Technology (Ministry) has now issued the long-awaited Executive Regulations to the PDPL under Ministerial Decision 34/2024 (Executive Regulations).

The Executive Regulations, which came into force on 5 February 2024, provide guidance on how personal data should be processed and managed in Oman. There is a grace period of one year to fully comply with the law in line with the Executives Regulations.

Data subject consent

The Executive Regulations clarify that the express written consent that must be obtained by the controller from the data subject before processing their personal data in line with the PDPL must (i) be issued by a data subject who full capacity; (ii) be issued in a clear manner and without coercion; and (iii) be documented in writing, electronically or any other manner specified by the data controller. Where the data subject is a child such consent must be given by the child's guardian.

Permitting

The Executive Regulations contain the details of the permitting process which is required for processing of sensitive personal data covered by Article 5 of the PDPL.

Data subject rights

In exercising their data subject rights under Article 11(a) to (e) of the PDPL (e.g. revoking their consent to processing or requesting their personal data to be deleted or amended, obtaining a copy of their data, or transfer of their data), the data subject must submit a written request to the data controller to exercise such rights, without any charge, and the data controller must respond to the request within no more than 45 days. During this period the data subject is entitled to request that the controller stops processing of their personal data until the request is addressed. The Executive Regulations give the data controller the right to reject such requests in whole or in part if they are unduly repetitive, or if complying with the request would entail extraordinary efforts. In any event, the data controller must inform the data subject of the rejection, with reasons.

It is clarified that the data subject can request deletion of their personal data if the purpose of processing no longer exists, where they cancel their consent or where the processing does not comply with the provisions of the law or the Executive Regulations.

In relation to the data subject's right to request a copy of their data from the controller, this can be supplied in paper or electronic form.

Data controller and data processor obligations

The Executive Regulations impose a number of key obligations on entities that control data and process data (as applicable), including:

• The adoption of a personal data protection policy accessible to data subjects before processing; this appears to be an additional display obligation relating to data subjects rights in addition to the notification information which must be given to the data subject prior to processing under Article 14 of the PDPL.
• Controller to obtain the data subject's consent before sending them any advertising, marketing or commercial material, and requires that the sending of such materials be suspended immediately on receiving a request from the data subject.
• They also detail the requirement to appoint an external auditor if the Ministry requests this under Article 16 of the PDPL. Such an auditor must be approved and licensed by the Ministry and be independent and not related to either the Controller or Processor whether directly or indirectly.
• They explain the obligation to establish a record of processing personal data including an extensive list of information that must be recorded, and an obligation to update it on an ongoing basis.
• They also expand on the procedure to be applied in terms of a data breach, including the information that must be supplied by the Controller to the competent department of the Ministry within 72 hours of awareness of any breach that would lead to a threat to the rights of data subjects.
• The Executive Regulations also provide details of the requirement to appoint a data protection officer (DPO) including the required qualifications and competences for a DPO and their tasks which include advising the controller or processor of their obligations under the PDPL and Executive Regulations, implementation of data protection policies and coordination with the competent department of the Ministry on issues related to Personal Data Processing.

Transferring personal data abroad

The Executive Regulations require the data controller to obtain the express consent of the data subject before transferring their personal data outside of Oman, and to ensure that such transfer does not jeopardise national security or the interests of the country. There are limited exemptions from obtaining such consent, if the transfer is in implementation of international obligation under an agreement to which Oman is a party or if the transfer is done in a way that results in the identity of the data subject remaining concealed and they cannot be identified in any way. The data controller must also ensure that the country to which the personal data is transferred has adequate personal data protection measures in place that are no less than those provided under the PDPL and the Executive Regulations. In this respect an assessment of the level of protection provided by the foreign party to whom the personal data is transferred and the risks of transferring the personal data must be carried out, and a copy of such report may be requested by the Ministry.

Complaints

• Complaints must be filed within 30 days of becoming aware of the infringement.
• The Controller must be informed by the competent department of the Ministry withing 7 days of receiving the complaint, and given 14 days to respond.
• The Ministry has 60 days from the end of that 14 day period to address the complaint and a failure to respond within this timeframe is considered a rejection.

Enforcement

In case of violation of the provisions of the Executive Regulations, the Ministry may impose the following administrative penalties:

• Issue a notice of violation.
• Suspend any Permit issued until the violation is removed.
• Impose an administrative fine not exceeding OMR 2000 for each violation.
• Cancellation any Permit issued.

What should my business do to comply with the Executive Regulations?

Businesses in Oman should now be actively taking steps to align their practices with the PDPL and the Executive Regulations, so as to ensure compliance by the end of the one-year grace period.