Artificial intelligence has advanced significantly in recent years. AI systems can now generate text, compose music, and create images and other works. These advancements have also raised significant legal concerns, particularly regarding intellectual property rights. AI developers often use copyrighted materials to train AI models, raising the risk that these models will create counterfeit or derivative works belonging to other people. This issue has not yet been addressed under Omani law: there is no specific legal provision or regulation governing the relationship between AI and intellectual property. By contrast, jurisdictions such as the United Kingdom, the United States, and the European Union have already begun to grapple with the problem and to explore potential solutions. Oman should therefore begin addressing this issue, drawing on the experience of these jurisdictions to inform its own approach.

The connection between artificial intelligence and intellectual property arises from AI’s growing capacity to create works similar to those made by human artists, such as images and music. This capacity makes it easier to reproduce the works of well-known artists and imitate their distinctive styles, raising the question of whether such conduct amounts to intellectual property theft or should instead be regarded as merely drawing inspiration from existing works.

The Omani Legal Framework

When examining Omani law at the intersection of artificial intelligence and intellectual property, the most prominent issue is the infringement of intellectual property rights by AI, and how such infringement, though contrary to law and ethics, has become so simplified and widely accessible that it is now available to anyone with the click of a button. This section examines how Omani law treats AI activities that rely on imitating or using copyrighted materials, guided by a single question: does Omani law treat the training of AI systems on copyrighted material as a violation of the law, or as a permissible exception?

Training an AI system involves compiling a large database of the data on which the model is trained, including words, letters, shapes, patterns, and colours, drawn from sources such as websites, books, articles, images, videos, music, and other works. Once this data is collected, it is presented to the system, which learns to recognise statistical patterns in it, analyse them, and generate similar patterns or predict the most likely next one through repeated exposure. Since this process requires assembling a dedicated database, the developer must first identify the data to include, download or copy it, and then store that copy electronically for later use in generating derivative outputs.

These steps matter because the Copyright and Neighbouring Rights Law, reserves the economic rights in a work to its author. Article 6 grants the author the right to reproduce the work, one of the most significant rights the law protects, as well as the right to adapt it into other forms, create derivative works, and dispose of the work in both its original and copied forms. Article 1 defines reproduction broadly as making one or more copies identical to the original, whether directly or indirectly, “by any means such as printing, photocopying, recording, or permanent or temporary electronic storage.” This definition captures precisely what AI training involves: the electronic storage of copyrighted works, a step that is fundamental to building a training database but is reserved exclusively to the author unless the author grants that right to another party by agreement.

There are, in principle, two ways an AI developer might avoid infringing copyright in this process. The first is to obtain the author’s consent to use the work for training purposes; although the law does not address this scenario explicitly, such permission would, as in other contexts, allow the work to be used lawfully. The second is for the training process to fall within Chapter Five of the law, which sets out the free uses of works. Article 20 lists uses that do not require the author’s consent, including use for explanation or critique, educational and informational purposes, copying by archives or public libraries, and use to illustrate a concept in a study, provided that certain conditions relating to the quantity used, the manner of use, and the absence of any direct or indirect financial gain are met. Article 20 makes no mention of AI or its training on copyrighted material. We therefore conclude that training an AI system without the author’s permission, and without relying on works in the public domain, constitutes a clear violation of copyright under Omani law. This gap, the complete absence of any law or regulation addressing AI’s use of copyrighted material, creates considerable uncertainty about how Omani law will respond to these issues as the technology continues to advance.

Comparison with Other Jurisdictions

The European Union offers a significant comparative model for Oman, having been the first jurisdiction to establish a comprehensive legal framework for artificial intelligence through the Artificial Intelligence Act (Regulation (EU) 2024/1689). The Act creates a framework intended to build trust in AI technology while protecting human rights and safety. Although it permits text and data mining for the training of general-purpose AI (GPAI) systems, this mechanism is subject to strict conditions and does not give AI developers a free pass to use copyrighted data. The Act requires generative AI providers to comply with existing EU copyright law, imposes transparency obligations regarding the content used to train AI models, and gives rights holders the option to opt out of having their content used for training.

Because GPAI providers require large datasets that may contain copyrighted material, questions arise over whether such use might constitute infringement. The EU addresses this largely through Directive (EU) 2019/790 on Copyright in the Digital Single Market, which introduced text and data mining exceptions under Articles 3 and 4. Article 3 permits research organisations to use protected content lawfully but excludes commercial or industrial uses. Article 4 allows other institutions to reproduce and extract data, subject to an opt-out mechanism that allows rights holders to exclude their work by ‘machine-readable’ means. What qualifies as machine-readable has been contested, notably in the German case Kneschke v LAION, in which a non-profit organisation used Kneschke’s copyrighted content to build an AI training dataset. The court rejected the copyright claim on the basis that the use fell within the text and data mining exception for scientific research, and held that a reservation expressed only in ordinary language was not sufficiently machine-readable. An appeal is pending.

Article 53(1)(d) of the Act further requires generative AI providers to publish a sufficiently detailed summary of the content used to train their models, and Recital 107 explains that this transparency requirement is intended to support copyright holders in exercising their rights. Even so, uncertainty remains over how far the existing text and data mining exceptions extend to AI training, and EU member states continue to debate whether the current framework adequately addresses the scale and complexity of the practice.

Most member states nonetheless favour monitoring and clarifying the existing framework rather than introducing new legislation immediately, given the continued novelty of generative AI. This cautious approach is instructive for Oman, which may similarly benefit from clarifying and monitoring its existing copyright principles rather than enacting an entirely new framework at this stage.

The United States has not enacted a comprehensive federal AI statute; regulation instead derives from a mix of executive orders, existing sectoral laws applied to AI, and state legislation. In Thomson Reuters v Ross Intelligence (2025), the court rejected a fair use defence where Ross had engaged a third party, LegalEase, to produce training data that substantially copied headnotes from Thomson Reuters’ Westlaw platform. The court found that Ross had directly copied thousands of these headnotes and rejected fair use primarily because Ross intended to use the resulting AI tool to compete directly with Westlaw, a factor the court held weighed decisively against fair use.

By contrast, in Bartz v Anthropic (2025), Anthropic had trained its Claude models using a mix of purchased and pirated books to build a permanent digital library, arguing that the books were essential to training its models. The court found that Anthropic’s use of purchased books constituted fair use, but that its use of pirated copies did not.

The US approach is therefore highly fact-specific, with outcomes varying case by case, and indicates that fair use may apply, but only within certain limits. The EU, by contrast, takes a legislative approach through the text and data mining exception in Directive (EU) 2019/790.

Jurisdictions aside from the EU and the USA have taken different approaches. The United Kingdom, for example, has no broad copyright exception permitting commercial AI training on protected works, although proposals for a text and data mining exception remain under discussion.

These divergent approaches show that there is no settled international consensus on whether copyrighted content may be used to train AI systems. Oman therefore has no single international model to follow and should instead weigh the interests of copyright holders against the goal of supporting AI development in determining its own approach.

Recommendations

The existing exceptions under Article 20 are tied to non-commercial, educational, or family contexts. We recommend amending Article 20 to introduce a new AI training clause permitting commercial entities to use copyrighted content for AI training, provided they have lawful access to that content, whether through licensing, subscription, or other authorised means. This carve-out is necessary because AI development in Oman is largely a commercial activity; without it, a company would remain excluded from the exception even where it has lawful access to the content it seeks to use. At the same time, original creators may face heightened competitive risk, as AI-generated content trained on their work could saturate the market with similar output and reduce demand for their future work.

Oman may also wish to adopt a gradual approach to regulating AI training on copyrighted content, rather than introducing a comprehensive AI-IP framework immediately, given that the technology remains relatively new and not yet fully understood. Instead, Oman should clarify the existing copyright law to specify the circumstances under which AI training can use protected work without infringing copyright, potentially through a text and data mining exception modelled on the EU approach, paired with an effective opt-out mechanism allowing copyright holders to reserve their work from AI training. Oman should also impose transparency obligations requiring AI developers to disclose the sources and content used to develop their systems, strengthening copyright holders’ ability to identify and enforce their rights without imposing an outright prohibition on the use of their content for AI training. Given the rapid development of generative AI and the current uncertainty in copyright law, these recommendations would allow Oman to protect copyright holders’ interests while continuing to encourage technological innovation.

These reforms also carry risks. A broad text and data mining exception could weaken copyright protection by allowing developers to use large quantities of copyrighted material, reducing copyright holders’ control over their work and its economic value. An opt-out mechanism may be difficult to enforce where ownership is unclear or content originates outside the country. Strict transparency requirements could impose high compliance costs on AI providers, potentially discouraging international companies from operating in Oman. There is also a risk that legislating before international approaches have stabilised could produce requirements that quickly become outdated.

Conclusion

Despite the risks of reform, the absence of regulation carries the greater risk: legal uncertainty. Without clear governance over whether copyrighted content can be used to train AI, both copyright holders and system developers face uncertainty in determining whether their conduct is lawful, which in turn complicates innovation in Oman. A carefully defined text and data mining exception would not eliminate copyright protection; rather, it would establish predictable circumstances in which works may be used, while preserving authors’ right to opt out. The goal should not be to eliminate all risk, an unrealistic aim, but to regulate use and provide greater certainty while respecting copyright holders’ rights. This is particularly important if Oman seeks to attract AI investment and build a competitive digital economy.

Authors

Nouf Al-Hoqani
University of Manchester, United Kingdom

—

Rayan Al-Hasni
Sultan Qaboos University, Oman

—

Zahra Al-Balushi
Modern College of Business and Science, Oman

—

Zayd Al-Harrasi
Nottingham Trent University, United Kingdom

—

The Personal Data Protection Law (Royal Decree No. 6/2022) has been in force since February 2023. It is Oman’s first comprehensive data protection statute, and a clear step forward from the single chapter of the Electronic Transactions Law that previously governed the field. Across its 32 articles, the PDPL grants data subjects a genuine set of rights and places clear obligations on controllers, giving the Sultanate a solid foundation to build on.

This policy brief examines that framework through the lens of data subject rights and identifies three areas where targeted refinement would strengthen it. First, the right of access could be broadened so that a copy of one’s data comes with the context needed to judge how it is being used. Second, a limited set of lawful bases could sit alongside consent, freeing consent to do its real work of protecting higher-risk processing. Third, a personal route to compensation could run alongside the Ministry’s enforcement role. Drawing on comparators including the UK GDPR and the Saudi and UAE frameworks, each reform builds on what the PDPL already does rather than reworking it.

As Oman Vision 2040 drives the growth of digital government, e-commerce, and cloud-based enterprise, individuals are increasingly asked to share their data to reach everyday services. Robust data subject rights are what allow them to take part in that digital future with confidence rather than exposure, making the case for reform both timely and central to the Sultanate’s wider economic ambitions.

Introduction

We live in an era where individuals constantly hand over sensitive information to organisations, often without knowing how it will be used, by whom, or for how long. Personal data has become an economic input for countless organisations, and while this has driven real benefits, in the form of more efficient markets and more responsive public services, the risks that come with it cannot be ignored.

The Basic Statute of the Sultanate of Oman already recognises the importance of personal privacy, establishing the inviolability of private life in Article 36. The Omani legislator went further with the Personal Data Protection Law (PDPL), issued by Royal Decree 6/2022 on 9 February 2022 and entering into force a year later. It is Oman’s first comprehensive piece of legislation dedicated to personal data protection, repealing and replacing Chapter 7 of the Electronic Transactions Law (Royal Decree 69/2008), which had governed the subject only in limited terms.

The PDPL runs to 32 articles, the first of which defines the key terms used throughout. It grants a set of rights to the data subject, the natural person identifiable through their personal data, and imposes obligations on the controller, who processes personal data or entrusts a processor to do so on the controller’s behalf. The processor, in turn, carries its own obligations under the law. The PDPL is supplemented by Executive Regulations issued under Ministerial Decision 34/2024, which fill in the detail the primary legislation left for the regulations to specify.

This brief looks at Omani law through the lens of the data subject. The first section sets out the rights the PDPL grants to data subjects, the second looks at where Omani law falls short against leading international standards, and the third sets out reforms to close those gaps.

What Rights Does the PDPL Give Data Subjects?

The PDPL grants data subjects six core rights under Article 11, but their practical strength varies considerably: some are stated in absolute terms, others depend on procedural detail the law defers elsewhere, and at least one presupposes a right the law does not clearly grant. Assessing that variation, rather than simply listing the rights, is the task of this section and the critiques that follow.

The rights granted to data subjects sit at the centre of any data protection framework, and the PDPL builds its own around a single gatekeeping requirement: personal data can only be processed after the data subject has given explicit, written consent. The law treats that consent as the operative condition for everything else, so the rights that follow are largely conditioned on it.

Article 11(a) gives the data subject the right to withdraw consent, bringing the processing relationship to an end. Article 11(b) lets the data subject ask for their data to be updated, amended, or blocked. Article 11(c) establishes the right of access, which matters because, without it, a data subject has no way to check whether their data is accurate or whether the controller has processed it beyond its original purpose (the Executive Regulations add procedural detail here). Article 11(d) grants a right to data portability, the transfer of one’s data to another controller, putting Oman among a small number of jurisdictions to grant a right of this kind. Article 11(e) grants the right to request erasure, subject to one exception for data processed for national archiving purposes. Finally, Article 11(f) entitles a data subject to be notified of any breach affecting their data, along with the action taken in response. Article 11 itself does not set out the procedures for exercising these rights; that detail, again, is left to the Executive Regulations.

Beyond Article 11, Article 12 gives data subjects a route to complain to the Ministry (MTCIT) where they believe their data has been processed unlawfully. The PDPL also imposes obligations on controllers that indirectly reinforce these rights, even though they are not framed as data subject rights themselves: Article 21 requires controllers to keep personal data confidential, Article 22 requires separate written consent before data is used for commercial or marketing purposes, and Article 23 prohibits cross-border transfers that are unlawful or that would harm the data subject.

Where the PDPL Falls Short for Data Subjects

A Right of Access That Doesn’t Go Far Enough

The right of access matters because it lets data subjects work out whether their data is being processed lawfully, and whether they need to exercise any of their other rights. But Article 11(c) of the PDPL only gives data subjects the right to obtain a copy of the personal data being processed. Article 11 also gives rights to amendment, blocking, erasure, and portability, but none of these oblige a controller to explain the broader context in which the data is being processed; those procedures, too, are left to the Executive Regulations.

Compare this with Article 15 of the UK GDPR, which treats access as extending well beyond the data itself. A controller responding to a UK access request must also disclose the purpose of processing, the categories of data involved, the recipients the data has been shared with, the envisaged retention period, the source of the data where it wasn’t obtained from the individual directly, and information about any automated decision-making. These requirements give data subjects what they need to judge whether processing is lawful, understand how their data is being used and shared, and decide whether to exercise their other rights.

This gap matters because several data subject rights turn on information a copy of the data alone won’t reveal. That copy won’t show whether data has been kept longer than necessary, shared with third parties, or used for a purpose it was never collected for: exactly the kind of thing Article 15 of the UK GDPR is designed to expose, and which might justify seeking reassurance, restriction, or objection. Article 12 of the GDPR reinforces this by requiring controllers to make it easy for data subjects to exercise their rights, and to provide information in a concise, transparent, and accessible form. Together, Articles 12 and 15 turn access from a simple entitlement to information into a practical tool that individuals can use to scrutinise how their data is handled. Oman’s narrower approach gives data subjects considerably less transparency over processing, and leaves them with a heavier burden: without that wider picture, spotting non-compliance becomes much harder.

Consent as the Only Lawful Basis

Article 11 of the PDPL makes unambiguous consent the general requirement for processing personal data, and the Executive Regulations (Ministerial Decision 34/2024) set out what that means in practice: consent must be freely given, not forced, given by a person with full legal capacity, and recorded in a form the controller determines, whether in writing or electronically. The law does carve out a small number of situations where consent isn’t required, namely meeting a legal obligation, protecting vital interests, and performing a contract to which the data subject is a party. These are exceptions to the consent requirement rather than alternative lawful bases in their own right, and the distinction matters: a controller falling outside these narrow exceptions has no basis to process data at all, while a data subject has no equivalent right to object to processing that does fall within them.

The comparison with other jurisdictions is telling. The UK GDPR sets out six lawful bases in Article 6, of which consent is only one; it pairs legitimate interests with a mandatory balancing test and gives individuals a right to object under Article 21, so people retain some control even where consent was never sought or given. The UAE’s Federal Decree-Law 45/2021 also recognises grounds beyond consent, including contractual necessity, legal obligation, and the legitimate interests of the controller. Most instructive of all is Saudi Arabia, whose Personal Data Protection Law (PDPL) began life just as consent-centric as Oman’s, before it was amended in 2023 to add legitimate interest as a standalone lawful basis, specifically because the original, consent-only draft proved unworkable for ordinary commercial processing. A regional peer identified the same flaw in its own law, and fixed it through legislation.

Oman’s consent-only structure creates two problems, and both work against the data subject rather than for them. First, requiring consent even for low-risk, routine, and entirely expected processing pushes controllers towards obtaining broad, bundled consent at the very start of a relationship, consent that may be formally valid but is meaningless in substance. Consent given as the price of receiving a service isn’t meaningfully free, and a system that demands consent for everything ends up producing consent worth having for nothing. Second, because the law has no general right to object, the only real control a data subject has is to withdraw a consent that was never truly voluntary to begin with; withdrawing consent for a service you still need is not much of a choice at all.

No Right to Compensation

On paper, the PDPL protects data subjects well. But when a violation actually causes harm, the law sends the data subject to the regulator rather than to a remedy of their own. The Ministry of Transport, Communications and Information Technology (MTCIT) controls enforcement, with the power to fine a controller or pursue criminal sanctions, a deliberate design choice that gives the regulator clear, centralised authority. Where the law falls short is that it gives individuals no direct route to compensation. A data subject can complain to the Ministry under Article 12, but that is their only channel: they have no standing to bring a controller before a court, no independent adjudicator sitting above the regulator, and no way to have a judge rule on whether their rights have been breached. If the Ministry chooses not to act, or simply doesn’t respond, the data subject’s options run out there.

That gap is felt most sharply where the harm is non-material: the distress of losing control of your data, reputational damage, or the exposure of sensitive details. In those cases, a data subject can be left with no personal remedy even where the Ministry does fine the controller. A fine serves the public interest in compliance; it does nothing to make the injured individual whole, and the two are not the same thing. For a law built around protecting the individual, that is a gap worth closing, and not an unusual one to close either: the GDPR and Brazil’s LGPD (Article 42) both give data subjects a direct route to compensation, showing this is a broadly accepted standard rather than a regional one.

Under Article 82 of the GDPR, a person can claim compensation directly from a controller for both material and non-material damage, and Article 79 gives them an effective judicial remedy against that controller on top of any complaint to the regulator. The Court of Justice of the European Union confirmed that this right has real substance: in Case C-300/21 (2023), it held that non-material harm doesn’t need to cross any threshold of seriousness to qualify, though a claimant must still show real damage and a causal link, not merely a breach. Saudi Arabia’s own PDPL takes the same approach: Article 40 lets anyone who suffers damage apply to a competent court for proportionate compensation for material or moral harm, moral harm being exactly the emotional and reputational injury at issue here, and that claim runs independently of any penalty the regulator imposes. The value of the court route isn’t only the payout: it puts an independent judge, rather than the regulator alone, in charge of deciding whether a person’s rights were actually breached.

A recent breach shows why the type of remedy matters. In May 2026, the Canvas learning platform, operated by Instructure, was hacked, exposing the personal data of students across thousands of institutions. The incident was resolved through a private settlement between the company and the attackers, not through any payment to the people whose data was exposed. Cases like this raise a hard question: what remedy should a data subject have when the processor wasn’t obviously at fault? The answer depends on the model. The GDPR’s liability is fault-based: Article 82(3) lets a controller or processor escape compensation if it proves it bears no responsibility for the event that caused the harm, meaning a genuinely blameless processor might avoid paying regardless.

Closing the Gaps: Reforms Centred on the Data Subject

A Right of Access Worth Having

Oman should strengthen the right of access by amending Article 11(c), or the Executive Regulations made under it, so that a copy of personal data comes with the context needed to make that right meaningful. Alongside the data itself, controllers should have to disclose the purpose of processing, the specific recipients, the applicable retention period, the source of the data where it wasn’t obtained from the data subject, and information about any automated decision-making, bringing Oman in line with Article 15 of the UK GDPR.

This matters most in the context of automated decision-making, where people can’t meaningfully assess or challenge a decision without understanding how it was reached. According to the Business and Human Rights Centre, Uber and Ola drivers in the Netherlands couldn’t challenge algorithmic dismissals until the courts confirmed that Article 15(1)(h) of the GDPR entitled them to information about the logic behind decisions that had ended their employment. An Omani worker facing an equivalent automated dismissal would currently have no comparable right. The UAE PDPL recognises a right to object to automated processing, while Saudi Arabia’s PDPL separately requires controllers to inform data subjects of the purpose and legal basis of data collection under Article 4. Neither, however, requires disclosure of the logic underlying automated decisions, so adopting the GDPR’s broader disclosure requirements would place Oman ahead of both regional counterparts.

Importantly, this reform could be implemented through the Executive Regulations rather than the primary legislation, making it one of the more practical recommendations in this brief: amending regulations is generally quicker, and less politically demanding, than amending a statute.

A Right to Compensation and Judicial Remedy

Oman’s framework is a strong foundation, and the fixes needed here are refinements rather than an overhaul. Following Saudi Arabia’s Article 40, and reinforced by Articles 79 and 82 of the GDPR, the law should give data subjects an express right to claim compensation before a competent court for both material and moral harm. That right should run alongside the Ministry’s existing enforcement powers, not replace them. The advantage of this approach is that it builds on rights Oman already has, while keeping the Ministry’s role intact and adding a personal remedy on top. The trade-off is that a court route adds cost and litigation risk for controllers, and requires the slower process of legislative change to put in place.

Oman would also do well to adopt a fault-based system of liability, along the lines of Article 82(3) of the GDPR: if a controller can prove it is not responsible for a violation, it should not have to compensate those affected by it. This offers an answer to the Canvas problem. Where there is no clear evidence that a processor caused or contributed to a violation, the appropriate course is to test whether it was negligent, or otherwise responsible, through a judicial process. Finally, limiting the amount of compensation a controller must pay, as Saudi Arabia’s Article 40 requires, would guard against a “floodgate” situation: controllers would still face real liability, but it would be limited and quantifiable rather than unlimited and unquantifiable.

Beyond Consent: A Safer Lawful Basis

Oman’s reform here should follow the Saudi model. Adding legitimate interests and contractual necessity as affirmative lawful bases, subject to a documented balancing assessment, would take the pressure off consent and let it function as a genuine safeguard for processing that is actually high-risk. The advantages are practical: controllers could manage fraud detection, network security, internal administration, and debt recovery without needing consent that no data subject would meaningfully refuse anyway, freeing enforcement resources to focus on processing that genuinely threatens people’s interests.

The risks, though, are real. Legitimate interest is a flexible standard, assessed by controllers themselves, and European experience shows how far it can be stretched: Meta tried to justify behavioural advertising first as a contractual necessity and then as a legitimate interest, and both arguments were rejected by the European Data Protection Board and the Court of Justice of the European Union. That example is an argument for safeguards rather than against reform: an obligatory, documented legitimate interest assessment, of the kind the UK Information Commissioner’s Office requires and opens to regulatory review, paired with a general right to object under Article 21 of the UK GDPR, would let Oman widen its lawful bases without leaving the data subject any less protected.

Why This Matters for Oman’s Digital Future

Protecting data subject rights is not a footnote to Oman’s digital transformation; it is central to it. As Oman Vision 2040 pushes digital government services, e-commerce, and cloud-based enterprise, ordinary people are increasingly required to hand over personal information to access basic services, often with little visibility into how that data is stored, used, or shared. Meaningful data subject rights, access, correction, erasure, and the ability to withdraw consent, give people real control over that exposure, rather than leaving them dependent on the goodwill of controllers. Without those protections, the same digital economy that Vision 2040 is built on becomes a source of risk rather than opportunity, through data misuse, breaches, and unauthorised disclosure. Strong data subject rights are what let people take part in Oman’s digital future with confidence, rather than vulnerability.

Conclusion

This brief began from a simple proposition: the PDPL exists to balance the interests of individuals who disclose their personal information against those of the organisations that control how it is processed. Before 2022, personal data in Oman was governed by a single chapter of the Electronic Transactions Law; today, it has a dedicated law built around it.

The gaps set out above, around access, consent, and remedies, show where that law still falls short for data subjects. The reforms proposed here would close them, giving data subjects real, usable protection over their own personal data.

Oman has pursued the digital economy as a central plank of Oman Vision 2040, treating it as a key tool for economic diversification away from hydrocarbon revenues. That pursuit has brought with it an expansion of digital government services, telecommunications, and cloud-based enterprise, and, with it, a corresponding rise in the processing of personal data, along with the risks that come with it: misuse, breaches, and unauthorised disclosure by the organisations entrusted with sensitive information. Protecting data subject rights should not be treated as secondary to a thriving Omani economy; the two go hand in hand.

Authors

Aatika Al-Hinai
Queen Mary University of London, United Kingdom

—

Mais Al-Hajri
Sultan Qaboos University, Oman

—

Malak Al-Kharusi
Leeds Beckett University, United Kingdom

—

Mohammed Al-Lawati
University of Liverpool, United Kingdom

—

The Sultanate of Oman is now a party to two of the most important international treaties governing cross border dispute resolution: The New York Convention, which deals with arbitration awards, and the Singapore Convention, which deals with settlement agreements resulting from mediation.

While both serve the same broad goal of making it easier to enforce the outcomes of alternative dispute resolution across borders, they differ in scope, mechanism, and history. This post examines what each convention does and how Oman has adopted them.

What Each Convention Does

New York Convention: Formally the United Nations Convention on the Recognition and Enforcement of Foreign Arbitral Awards. This convention creates a uniform mechanism for enforcing arbitral awards issued in one contracting state within the territory of another, eliminating the need to relitigate the dispute from scratch.

Singapore Convention: Formally the United Nations Convention on International Settlement Agreements Resulting from Mediation. It does for mediation what the New York Convention did for arbitration, enabling direct enforcement of international mediation settlement agreements across member states.

Given the key difference between arbitration and mediation, the New York Convention is used to enforce the arbitral award decided by the arbitration tribunal, while the Singapore Convention is used to enforce the settlement agreement signed between the parties to a mediation process.

Oman’s Accession: A Timeline

Oman acceded to the New York Convention, which was entered into force in 1959, through Royal Decree 36/98, making it part of Omani law with effect from 10 June 1998.

Nearly three decades later, Oman joined the Singapore Convention, which entered into force in 2020, through Royal Decree 6/2026, issued on 11 January 2026. Oman is considered one of the early adopters of the Singapore Convention.

What This Means for Businesses

For international companies and investors in Oman, the practical significance is straightforward. An arbitral award issued in any of the 170+ New York Convention member states can be enforced in Oman without relitigating the merits.

Now, a settlement agreement resulting from mediation conducted in any Singapore Convention member state enjoys a similarly streamlined pathway. Mediation settlements are no longer “weaker” instruments; they are legally binding and enforceable.

Interaction with Omani Law

Given the maturity of the arbitration framework in Oman, the New York Convention operates directly and clearly within the legal framework of the Law of Arbitration in Civil and Commercial Disputes and the Civil and Commercial Procedures Law. Article 1 of the Arbitration Law expressly preserves the primacy of international agreements, while article 9 grants the Court of Appeal in Muscat jurisdiction over international commercial arbitrations. Article 58 stipulates that enforcement requires that the award does not violate Oman’s public order and that the award is final in its country of origin.

Oman does not currently have a proper legal framework for governing mediation as a form of alternative dispute resolution, nor does it have any legal provisions that govern settlement agreements arising out of mediation proceedings outside the general provisions of the Civil and Commercial Procedures Law that are triggered when the parties decide to settle a dispute that has already been presented before the court, not those that have independently been reached by the parties without starting litigation first. The Law of Public Notaries can be used to give settlement agreements the power of enforcement documents, but this requires both parties to notarise the agreement before the Public Notary, which is not usually possible if one of the parties is not in Oman.

It is worth noting that the mediation concept found in the Singapore Convention is not the same as the mediation concept found in the Omani Law of Mediation and Conciliation, which relates to mediation through official government tribunals, and not through an independent mediator.

This means that even though Oman is legally bound to provide a mechanism for recognising settlement agreements resulting from mediation, a domestic legal framework still does not exist for the courts to enforce such agreements.

Conclusion

This blog post highlighted the key differences between the New York Convention and the Singapore Convention and how each operates within the Omani legal framework.

For the Singapore Convention to achieve its objectives, Oman must consider issuing a standalone mediation law as well as specific provisions for the courts to enforce settlement agreements that meet the requirements of the Singapore Convention.

You can read the full text of the Singapore Convention on the link below:

Pre-requisites

Before exploring the paths through which nationality can be obtained, it is important to note that the law in Oman does not generally permit a person to hold Omani nationality except by a specific royal decree permitting this. The law does not provide any details on the grounds for obtaining this royal exception, but this appears to be an extremely rare thing to obtain as only 18 number of people were allowed to simultaneously hold Omani with another one in the last 20 years.

Moreover, all applications to acquire Omani nationality must be submitted to the Ministry of Interior, which reviews and decides on them in accordance with the legal procedures and controls. Unlike most other government decisions, the decisions of the Ministry of Interior in this area are not subject to challenge through the administrative judiciary.

Nationality by Origin

Omani nationality can be acquired by origin, which is the most common and easiest way of getting a nationality. Whoever is born by an Omani father, be it in Oman or abroad, is deemed an Omani by origin.

The law states that those born by an Omani father and a non-Omani mother are deemed Omani by origin on the condition that the marriage has been approved by the Ministry of Interior. However, after the issuance of the Royal Decree 23/2023 regarding the Marriage of Omanis to Foreigners which removed the requirements to obtain government approval to permit an Omani to get married to a non-Omani, it is assumed that this requirement for the approval is no longer required for the Omani father to pass nationality to his children.

Moreover, whoever is born in Oman to unknown parents or born to an Omani Mother (in Oman or abroad) and his lineage to his father cannot be legitimately proven is deemed an Omani by origin and qualifies for obtaining Omani nationality.

Nationality by Reinstatement

Omanis who lose their nationality by renouncing it may obtain their Omani nationality again by reinstatement. This process requires the person to make an application and to meet several conditions, such as that he is of good behaviour and conduct, is habitual residence is in Oman or has returned to it, and declares in writing his desire to settle in it, and that he is free of communicable diseases.

Nationality by Grant

It is also possible for foreigners to obtain Omani nationality by submitting an application to the Ministry of Interior. The criteria for obtaining nationality here depend on whether the person is a foreigner, a foreign wife of an Omani person, a foreign widow or divorcee of an Omani, or a minor child of an Omani woman from her foreign husband.

For a foreigner who does not meet any of the other conditions, they are required to prove legitimate continuous residency in Oman for a period no less than 20 years (or 15 years if he is a man married to an Omani woman), they must be fluent in Arabic, and they must have a legitimate source of income to meet his needs and other conditions.

For a wife of an Omani, she must have a child from that husband, must speak Arabic, and must be married to him for a period no less than 10 years.

For a widow or divorcee of an Omani, she must also have a child from that husband, must not be married to a non-Omani, must speak Arabic, and must be resident in Oman for a continuous period of 15 years.

For a minor child of an Omani woman from a non-Omani husband, there are a different set of conditions including that the mother is widowed or divorced and that the child has lived in Oman for a period no less than 10 continuous years.

It is worth noting that meeting the prescribed criteria does not mean the automatic approval to obtain the nationality, as the Ministry of Interior would have decide on each case on its own. It is also worth noting that in all cases, it is possible to acquire an exemption by virtue of royal decree to obtain Omani nationality without complying with all the nationality criteria set by this law.

The Omani Nationality Law is a very interesting piece of legislation to read. You can read it in full in English on the link below:

Both regulations are based on the International Ship and Port Facility Security Code (ISPS Code), which Oman ratified by Royal Decree 63/2004. The new regulation comprehensively updates the governance of ship and port facility security. For example, it incorporates a new structure for port facility security verification, introduces new obligations for different stakeholders, establishes a new framework to license private companies to carry out certain tasks related to ship and port facility security including ship security verification, and imposes administrative fines that the MTCIT can impose if the regulation is not complied with.

You can read the decision in full in English on the link below:

The Wage Protection System is a framework created by the MOL that makes it a legal requirement for all employers in Oman to transfer the salaries of their workers using a specific electronic system through banks and other financial institutions licensed by the Central Bank of Oman. The objective of this system is to ensure that the salaries of workers are paid on time and that there is an electronic record of the transfer of the salaries.

Key changes in the new system include reducing the timeframe for transferring the wages of workers from 7 days to 3 days and introducing new grounds for the exemption from using the wage protection system such as situations where a worker is suspended from work for a reason not attributable to the employer for a period exceeding 30 days.

The new Wage Protection System has already entered into force. You can read it in full in English on the link below:

While the exact provisions can vary, most BITs share several common elements, including the duty to offer foreign investors treatment that is not less favourable than the treatment offered to national investors or investors from other states (national treatment and most-favoured-nation treatment), offer investors fair and equitable treatment, protect their investments against expropriation, and give investors the right to use several dispute resolution mechanisms.

National Treatment and Most-Favoured-Nation Treatment

A key provision in BITs is that the state has a duty to treat foreign investors and their investments at a standard that is not less favourable than the treatment it offers its own national investors or the investors of any other state. This concept has a wide scope and can relate to matters such as legal protections and access to markets in a manner that prevents discriminatory practices that target foreign businesses, including the payment of taxes. The objective of this clause is to create a level playing field and promote fair competition.

Protection Against Expropriation

Expropriation relates to the confiscation by the government of the private property of others. BITs typically include provisions to protect investors from unlawful expropriation of their investment by the government and set conditions for permitting expropriation if it is done for a public purpose, is non-discriminatory, and adheres to due process. Additionally, any expropriation must be followed by prompt, adequate, and effective compensation. In addition to this being translated in article 24 of the Foreign Capital Investment Law, Oman has a comprehensive framework for this in the Law on the Expropriation for Public Benefit.

Dispute Settlement Mechanism

The most critical feature of a BIT is the dispute settlement mechanism that allows an investor to enforce their rights against the host country if the country fails to meet its obligations under the treaty. A standard BIT would allow the investor to make a claim at their choice of venue, including making a claim through an arbitration process before the International Centre for Settlement of Investment Disputes (ICSID).

Conclusion

BITs provide a powerful mechanism for protecting and enforcing the rights of foreign investors. Oman traditionally used to sign these treaties frequently with other states, but the number of new treaties has been declining with the most recent one being Oman-Hungary BIT which was ratified in 2022.

The Oman Net Zero Centre will not be an independent government entity, but a department in the MEM at the level of a directorate general. The decision details the mandates of Oman Net Zero Centre which include preparing and updating the national plan for transition to net zero, providing support and advice to relevant entities and institutions with the aim of achieving net zero targets, preparing the national plan to enhance energy consumption efficiency, approving and registration application for trading in carbon credits, among other functions.

You can read this MEM decision in full in English on the link below:

While the actual Law on the Management of Pastures and Livestock included criminal fines for those who violate the law, the original Executive Regulation of the Law on the Management of Pastures and Livestock of 2005 did not grant the ministry the power to issue smaller administrative fines to hold those who commit small offences accountable for their violations. The new amendment changes this by giving this power to the MAFWR by allowing it to impose administrative penalties, such as issuing a warning, ordering the removal of the violation, or cancelling the licence if a licensee violates any of the provisions of the regulation. The new amendment also gives the ministry the power to impose a fine not exceeding 2,000 Rial Omani for each violation with the opportunity to double this fine if the violation is repeated.

You can read this regulation in full in English on the link below:

Contracts are the foundation of business relationships, outlining rights, obligations, and expectations between parties. However, despite careful planning and collaboration, disputes can arise, leading to costly and time-consuming legal battles. That’s where a well-crafted Alternative Dispute Resolution (“ADR”) clause comes into play. ADR refers to the different ways people can resolve disputes without a trial. Common ADR processes include mediation, arbitration, and neutral evaluation. In this article, we will explore the significance of including an ADR clause in contracts and how it can provide a fair and efficient means of resolving conflicts.

Firstly, an ADR clause helps reduce the cost of disputes. It is commonly known that litigation is often the default path for resolving disputes; however, this can be an expensive and lengthy process. Therefore, a well-drafted ADR clause offers an alternative by providing a clear roadmap for resolving conflicts outside of the courtroom. By specifying a preferred method of dispute resolution, such as mediation or arbitration, parties can save significant time, money, and resources.

Furthermore, an ADR clause serves to maintain control and confidentiality. In fact, one of the key advantages of including an ADR clause is that it allows parties to maintain control over the resolution process. Unlike litigation, where decisions are made by a judge, ADR methods enable the parties to choose a neutral third party or panel to oversee the process. This allows for greater flexibility, confidentiality, and the ability to craft solutions that best suit the specific circumstances of the dispute.

Moreover, an ADR clause aids in preserving business relationships. In business, maintaining positive relationships is crucial for long-term success. Engaging in a public and adversarial court battle can strain relationships and damage reputations. An ADR clause encourages parties to resolve conflicts amicably, preserving working relationships and promoting future collaboration. It shows a commitment to finding common ground and finding mutually beneficial solutions rather than resorting to litigation.

Additionally, an ADR clause facilitates speed and efficiency. Indeed, disputes can be time-consuming, diverting valuable resources and attention away from core business activities. With a well-defined ADR clause, parties can establish a timeline and procedure for resolving conflicts, ensuring a more efficient and timely resolution. ADR methods, such as mediation or arbitration, typically offer streamlined processes that prioritize a swift resolution.

It is noteworthy that an ADR clause is the result of a tailored process to fit the dispute. As every dispute is unique, a one-size-fits-all approach may not be the most effective solution. An ADR clause allows parties to tailor the process to the specific needs of their dispute. They can choose the most suitable method, select a qualified neutral party with expertise in the relevant field, and set guidelines for the proceedings. This flexibility helps ensure a more targeted and effective resolution.

As well, an ADR clause is important in international contracts. In today’s globalized business landscape, contracts often span international borders. In such cases, an ADR clause becomes even more critical. It helps parties navigate differences in legal systems, languages, and cultural norms. By specifying a method of dispute resolution that is recognized and enforceable internationally, such as arbitration under a respected institution like the International Chamber of Commerce (“ICC”) or the London Court of International Arbitration (“LCIA”), parties can ensure that their disputes are resolved in a neutral and impartial manner. In other words, including an internationally recognized method of dispute resolution, such as arbitration under a renowned institution, provides parties with confidence and a familiar framework for resolving cross-border conflicts.

In conclusion, an ADR clause is a powerful tool that empowers parties to address conflicts in a fair, efficient, and mutually agreeable manner. By proactively including this clause in contracts, businesses can minimize the risk of costly litigation, preserve relationships, and maintain control over the resolution process. Whether it’s through mediation, arbitration, or another alternative method, the inclusion of a well-crafted ADR clause demonstrates a commitment to resolving conflicts with confidence and integrity.

Wadhah Talib Yahya Al-Hinai is an Omani lawyer with a background in legal research and academia. Currently serving as a Legal Researcher at the Legal Affairs Department of Sultan Qaboos University, he also lectures on Business Law at the College of Economics and Political Sciences of the same university. Passionate about law and education, Wadhah is dedicated to advancing legal knowledge and nurturing the next generation of legal professionals.

If you would like to contribute to the Decree Blog, feel free to email us at blog [at] decree [dot] com.