Formation and Framework

The Basic Statute of the State, often referred to as the Constitution of Oman, establishes the framework for forming the Council of Ministers and specifies its duties. It outlines the conditions for appointing the Prime Minister, deputy prime ministers, and other ministers, all of whom must be appointed by royal decree. While His Majesty Sultan Haitham Bin Tarik currently serves as the Prime Minister, the Basic Statute of the State provides a mechanism to appoint another individual to fulfil this role if necessary.

Key Duties of the Council of Ministers

As stipulated in article 51 of the Basic Statute of the State, the Council of Ministers is entrusted with a wide range of responsibilities, which can be categorised into three main areas:

Legislative Duties

One of the key responsibilities of the Council of Ministers is its legislative function. The Council of Ministers submits recommendations to the Sultan on matters of concern to the state, ensuring that key issues are addressed effectively. Additionally, it proposes draft laws and royal decrees, which are then issued by His Majesty after going through Majlis Oman. These legislative functions are fundamental in shaping the legal framework and maintaining the rule of law in Oman.

Setting State Policies

Another critical area of responsibility is setting state policies. The Council determines the general objectives and policies for comprehensive development, laying the groundwork for national progress. It also establishes the necessary procedures to implement these policies, ensuring their effectiveness. Furthermore, the Council debates development plans prepared by competent authorities, presenting them to Majlis Oman for review before submitting them to the Sultan for approval. Through these efforts, the Council of Ministers ensures that the policies are aligned with the public interest and national priorities.

Oversight Duties

Equally important are the Council of Minister’s oversight duties. The Council of Ministers oversees the functioning of the administrative apparatus of the state, ensuring that its various units perform their duties efficiently and in compliance with established laws and regulations. It monitors the implementation of laws, royal decrees, regulations, decisions, treaties, agreements, and court judgments, ensuring strict adherence to them. In addition, the Council of Ministers reviews proposals from ministries in their respective areas of competence, facilitating coordination and making informed decisions. These oversight responsibilities are crucial for maintaining efficiency, accountability, and transparency across the government.

These were some of the key duties of the Council of Ministers, you can read learn more about this extremely important government body by reading the Basic State of the State.

Written by:

Saja Al-Hosni

Saja is a legal intern at Decree. She has previously interned in an Omani law firm and in the University of Liverpool Law Clinic. She is interested in commercial, corporate, and international investment law. She holds an LLB from the University of Liverpool.

Pre-requisites

Before exploring the paths through which nationality can be obtained, it is important to note that the law in Oman does not generally permit a person to hold Omani nationality except by a specific royal decree permitting this. The law does not provide any details on the grounds for obtaining this royal exception, but this appears to be an extremely rare thing to obtain as only 18 number of people were allowed to simultaneously hold Omani with another one in the last 20 years.

Moreover, all applications to acquire Omani nationality must be submitted to the Ministry of Interior, which reviews and decides on them in accordance with the legal procedures and controls. Unlike most other government decisions, the decisions of the Ministry of Interior in this area are not subject to challenge through the administrative judiciary.

Nationality by Origin

Omani nationality can be acquired by origin, which is the most common and easiest way of getting a nationality. Whoever is born by an Omani father, be it in Oman or abroad, is deemed an Omani by origin.

The law states that those born by an Omani father and a non-Omani mother are deemed Omani by origin on the condition that the marriage has been approved by the Ministry of Interior. However, after the issuance of the Royal Decree 23/2023 regarding the Marriage of Omanis to Foreigners which removed the requirements to obtain government approval to permit an Omani to get married to a non-Omani, it is assumed that this requirement for the approval is no longer required for the Omani father to pass nationality to his children.

Moreover, whoever is born in Oman to unknown parents or born to an Omani Mother (in Oman or abroad) and his lineage to his father cannot be legitimately proven is deemed an Omani by origin and qualifies for obtaining Omani nationality.

Nationality by Reinstatement

Omanis who lose their nationality by renouncing it may obtain their Omani nationality again by reinstatement. This process requires the person to make an application and to meet several conditions, such as that he is of good behaviour and conduct, is habitual residence is in Oman or has returned to it, and declares in writing his desire to settle in it, and that he is free of communicable diseases.

Nationality by Grant

It is also possible for foreigners to obtain Omani nationality by submitting an application to the Ministry of Interior. The criteria for obtaining nationality here depend on whether the person is a foreigner, a foreign wife of an Omani person, a foreign widow or divorcee of an Omani, or a minor child of an Omani woman from her foreign husband.

For a foreigner who does not meet any of the other conditions, they are required to prove legitimate continuous residency in Oman for a period no less than 20 years (or 15 years if he is a man married to an Omani woman), they must be fluent in Arabic, and they must have a legitimate source of income to meet his needs and other conditions.

For a wife of an Omani, she must have a child from that husband, must speak Arabic, and must be married to him for a period no less than 10 years.

For a widow or divorcee of an Omani, she must also have a child from that husband, must not be married to a non-Omani, must speak Arabic, and must be resident in Oman for a continuous period of 15 years.

For a minor child of an Omani woman from a non-Omani husband, there are a different set of conditions including that the mother is widowed or divorced and that the child has lived in Oman for a period no less than 10 continuous years.

It is worth noting that meeting the prescribed criteria does not mean the automatic approval to obtain the nationality, as the Ministry of Interior would have decide on each case on its own. It is also worth noting that in all cases, it is possible to acquire an exemption by virtue of royal decree to obtain Omani nationality without complying with all the nationality criteria set by this law.

The Omani Nationality Law is a very interesting piece of legislation to read. You can read it in full in English on the link below:

Written by:

Amjad Al-Yahya’ei

Amjad is a legal intern at Decree. He has previously interned in an investment company and in the public utilities sector. He is interested in corporate law, investment law, and dispute resolution. He holds an LLB from the University of Liverpool.

The types of passports are determined by the Law of the Omani Passport. However, due to the fact that some types of passports are issued by the Foreign Ministry, and not the Royal Oman Police, certain provisions relating to those passports are also governed by the Law Governing the Foreign Ministry.

Ordinary Passports

The only substantive provision for obtaining an ordinary Omani passport is that the person making the application is an Omani national. Its period of validity is 10 years and it is issued by the Royal Oman Police. This is the most common type of passport that the majority of Omanis hold.

Diplomatic Passports

The diplomatic passport is the most powerful Omani passport, it is issued by the Foreign Ministry, and not the Royal Oman Police, and it is governed in detail by the Law Governing the Foreign Ministry. The law specifies categories of high-level government officials, including the prime minister, deputy prime ministers, high-ranking members of the royal family, ministers, diplomats, and other high-ranking government officials who qualify for obtaining this passport.

With the exception of high-ranking members of the royal family, the spouse and children of a holder of a diplomatic passport also qualify for obtaining a diplomatic passport.

Technically speaking, there is no legal requirement for an Omani diplomatic passport to be issued to an Omani national, so—in theory—if a non-Omani person qualifies and is appointed to a high-rank government position, that person would qualify for having a diplomatic passport.

Special Passports

Special passports are a unique category of passports that are not found in many countries around the world. In Oman, like diplomatic passports, these are issued by the Foreign Ministry and not the Royal Oman Police, and it is also governed in detail by the Law Governing the Foreign Ministry. They are primarily given to members of the royal family who do not qualify for diplomatic passports, members of the Council of Oman, undersecretaries, and other high-ranking government officials who do not qualify for diplomatic passports.

The spouse and children of a holder of a special passport also qualify—in certain cases—for a special passport.

Similar to diplomatic passports, there is no requirement for a holder of a special passport to be an Omani national, and—in theory—it can be given to non-Omanis who meet the criteria for having this passport.

Service (Mission) Passports

A service passport, formally named a mission passport in the Law of the Omani Passport, is another passport issued by the Foreign Ministry and not the Royal Oman Police, and it is also governed in detail by the Law Governing the Foreign Ministry. This passport is given to government officials on missions to represent the government in official meetings and conferences based on the recommendation of the head of the unit on which the government official works. Unlike diplomatic and special passports, the spouse and children of the holders of service passports do not qualify in any situation to hold this passport. However, similar to diplomatic passports, there is no requirement for a holder of a special passport to be an Omani national, and it can be given to non-Omanis who meet the criteria for having this passport.

Travel Documents

A travel document is a temporary passport-like travel document that is issued by the Royal Oman Police to non-Omanis who live in Oman and do not have a nationality to allow them to leave the country in certain circumstances.

Laissez Passer

A laissez passer is a temporary travel document given only to Omanis usually with the objective of allowing an Omani person who has lost his passport abroad to return home.

Objectives of Different Passports

While the objectives of a travel document and a laissez passer are obvious, the benefits of diplomatic, special, and service passports might not seem very obvious. A diplomatic passport can be understood to mean that a person enjoys a diplomatic status and therefore enjoys certain protections and immunities when traveling aboard in countries that recognise such products. However, a more practical value for all these passports is that Oman very frequently signs bilateral visa exemption agreements with other countries that specifically allow the holders of diplomatic, special, and service passports to travel to these countries without the need to obtain a visa. Examples of such countries include Switzerland, Italy, Greece, and many other countries to which an Omani person would require a visa to travel, but holders of diplomatic, special, and service passports would be able to travel on official business without the need to obtain a visa.

You can learn more about the Omani passport by reading the Law of the Omani Passport on the link below:

Written by:

Azza Al-Abri

Azza a legal intern at Decree. She has previously interned in the banking sector and in private practice. She is interested in corporate law. She holds a LLB from the University of Leeds.

The Omani Basic Statute of the State was first promulgated in 1996 by Sultan Qaboos by Royal Decree 101/96, as a gift to the people of Oman. The Basic Statute of the State provided a general legal framework upon which Oman operates, establishing its status and role as a constitution in Oman. However, since it is not formally called a constitution (or a Dostour in Arabic) and was promulgated merely by royal decree, some may doubt its legal status as the constitution.

To answer this question, this post will examine the Basic Statute of the State from a number of dimensions, namely, its name, its supremacy over other documents, its content, and its entrenchment, all of which are key attributes of constitutional documents.

Name of the Basic Statute of the State

Constitutions are commonly titled as constitutions, or the Dostour in Arab countries, to clarify their legal status. Therefore, since the Basic Statute of the State is not labelled as the Omani constitution, it can be perceived as a regular law. Nonetheless, this on its own should not be the determining factor for denying the Basic Statute of the State its constitutional status as not all internationally recognised constitutions are formally named as constitutions. For example, in Germany, the constitution is called the Basic Law for the Federal Republic of Germany. Furthermore, the term Dostour originates from the Farsi language, not Arabic, and therefore it is not unreasonable for an Arab country to choose not to name its constitution as a Dostour and use an alternative Arabic name for it.

Supremacy of the Basic Statute of the State

A key aspect of any constitution is that it is the most supreme document of the land. Oman’s Basic Statute of the State declares itself as the supreme legal authority in Oman in article 96 which explicitly mandates that all laws, decrees, and regulations must conform to its provisions, and in article 97 which mandates that no entity can issue any form of law that contradict the Basic Statute of the State. This is also confirmed in practice as every single royal decree that was issued after the promulgation of the Basic Statute of the State starts by referencing the Basic Statute of the State as the legal basis for issuing these royal decrees.

Contents of the Basic Statute of the State

Constitutions around the world are meant to outline the governance framework by which a government operates and set the fundamental rights that are guaranteed to the people. In Oman, the Basic Statute of the State carries out this exact function. Across the different Books of the statute, the Omani framework of governance and the branches of the state and their powers have been detailed to include the Sultan, Council of Ministers, Majlis Oman, and the judiciary. Each of these bodies echoes similar functions as the three main branches of the state (the executive, the legislature, and the judiciary) found in traditional constitutional charters. Furthermore, Book Three of the Basic Statute of the State grants the people various fundamental rights such as the right to life and dignity, the right to equality and security of life, the right not to be arrested, searched, detained, or imprisoned, the right not to be subject to torture, the right to freedom of religion, the right to freedom of opinion and expression, the right to private life, and many more. These elements reflect the key elements found in other constitutions around the world.

Entrenchment of the Basic Statute of the State

Constitutions are traditionally entrenched, i.e. difficult to change, by highly demanding repeal or amendment requirements to ensure the stability of the foundations of the legal system. The Omani Basic Statute of the State appears to lack this attribute, since article 98 of the Basic Statute of the State provides that its articles can be amended the same way they were promulgated, which is merely by a royal decree without any requirements for the change to go through Majlis Oman. However, even though issuing a royal decree can be seen as an easy thing to do, history demonstrates that the Omani Basic Statute of the State is not easy to amend since it has only been amended twice since its promulgation in 1996, the first was in 2011 when the entire Arab World was going through a massive wave of change during the Arab Spring, and in 2021 after Sultan Haitham came into power. Accordingly, even though the Basic Statute of the State might appear to be capable of amendment at any time, the history of Oman demonstrates that it is rarely ever amended and only in extreme circumstances.

Conclusion

To conclude, even though the Basic Statute of the State is not officially labelled as the Omani constitution, it enjoys many of the attributes of formal constitutions recognised around the world, especially in regard to the supremacy and contents of the document.

Being the most important legal document in the country, I highly recommend that everyone reads the Omani Basic Statute of the State, which is available for free in English at this link:

Written by:

Azza Al-Abri

Azza a legal intern at Decree. She has previously interned in the banking sector and in private practice. She is interested in corporate law. She holds a LLB from the University of Leeds.

While the exact provisions can vary, most BITs share several common elements, including the duty to offer foreign investors treatment that is not less favourable than the treatment offered to national investors or investors from other states (national treatment and most-favoured-nation treatment), offer investors fair and equitable treatment, protect their investments against expropriation, and give investors the right to use several dispute resolution mechanisms.

National Treatment and Most-Favoured-Nation Treatment

A key provision in BITs is that the state has a duty to treat foreign investors and their investments at a standard that is not less favourable than the treatment it offers its own national investors or the investors of any other state. This concept has a wide scope and can relate to matters such as legal protections and access to markets in a manner that prevents discriminatory practices that target foreign businesses, including the payment of taxes. The objective of this clause is to create a level playing field and promote fair competition.

Protection Against Expropriation

Expropriation relates to the confiscation by the government of the private property of others. BITs typically include provisions to protect investors from unlawful expropriation of their investment by the government and set conditions for permitting expropriation if it is done for a public purpose, is non-discriminatory, and adheres to due process. Additionally, any expropriation must be followed by prompt, adequate, and effective compensation. In addition to this being translated in article 24 of the Foreign Capital Investment Law, Oman has a comprehensive framework for this in the Law on the Expropriation for Public Benefit.

Dispute Settlement Mechanism

The most critical feature of a BIT is the dispute settlement mechanism that allows an investor to enforce their rights against the host country if the country fails to meet its obligations under the treaty. A standard BIT would allow the investor to make a claim at their choice of venue, including making a claim through an arbitration process before the International Centre for Settlement of Investment Disputes (ICSID).

Conclusion

BITs provide a powerful mechanism for protecting and enforcing the rights of foreign investors. Oman traditionally used to sign these treaties frequently with other states, but the number of new treaties has been declining with the most recent one being Oman-Hungary BIT which was ratified in 2022.

Written by:

Amjad Al-Yahya’ei

Amjad is a legal intern at Decree. He has previously interned in an investment company and in the public utilities sector. He is interested in corporate law, investment law, and dispute resolution. He holds an LLB from the University of Liverpool.

As an Omani law student in the UK, I wrote this blog post to examine the key differences between Omani and UK company legal forms.

General Concept of a Company

In Oman, the term “company” refers to any business vehicle other than a sole trader doing business as an individual in his or her personal capacity. Accordingly, a partnership, i.e. the legal form where two or more partners carry out an activity together with one or more of the partners having no limited liability, is considered a type of a company in Oman, is governed by the Commercial Companies Law, and is referred to as a Tadhamun Company (General Partnership) or Muhassa Company (Limited Partnership). The Omani concept of a company widens more as the Omani law considers a joint venture, merely a contract between two parties to carry out a joint project, to be a company form and regulates it under the Commercial Companies Law.

This differs from the UK, where the term “company” usually refers to a specific type of business vehicle with limited liability and a legal personality distinct from its shareholders. Other business vehicles, such as partnerships, are governed by a totally different set of legislation. The UK also does not consider venture capital a form of a company. However, the UK also has a hybrid business form between a company and a partnership called a Limited Liability Partnership that does not exist in Oman.

Limited Liability Companies

In Oman, the Commercial Companies Law has several types of what is generally considered a limited liability company, i.e. a legal form with a legal personality distinct from the shareholders who have limited liability towards the conduct of the business. These are the One Person Company (a limited liability company with one shareholder), a Limited Liability Company (a limited liability company with a maximum of 50 shareholders, and a Joint Stock Company (a limited liability company with a minimum capital of 2,000,000 Rial if the shares of the company are traded in the stock market or a minimum capital of 500,000 if the shares of the company are not traded in the stock market. The law also has specific rules for a holding company (a joint stock company created for the purpose of owning other companies).

In the UK, there is no distinction in the actual legal form identified by Omani law; all are merely referred to as a Limited Company. This company can be owned by one or multiple people, and there is no cap on the number of shareholders a company can have. The same applies in regard to publicly traded companies. A Limited Company can trade its shares on the stock market in the UK without having to adopt a different legal form.

Limited Liability Partnerships

Oman only has the traditional legal forms of a general partnership and a limited partnership in the area of partnerships. These forms also exist in the UK and offer a legal form jointly owned by the shareholders without offering limited liability except to limited partners in a limited partnership. However, the UK also offers a hybrid form between a company and a partnership called a Limited Liability Partnership (LLP) as a legal vehicle in which all the partners have limited liability, allowing them to manage the business directly without needing a board of directors. LLPs allow for a different tax treatment than an LLC, as the partnership is not subject to corporation tax and the partners are individually taxed through self-assessment tax returns as the profits are directly distributed among them.

Beyond UK Business Legal Forms

In addition to the standard limited company, partnerships, and limited liability partnerships, the UK also has several legal forms available for some specific purposes that are not necessarily profit-oriented, such as Community Interest Companies that prioritise community benefits over profit; Right to Manage Companies that are formed by leaseholders to manage their building; and UK Societas’ that provide a framework for operating across the UK and EU (formally known as Societas Europaea before Brexit).

Conclusion

Company Law is one of the critical areas of law for any person interested in corporate legal work. I highly recommend reading the Commercial Companies Law to learn about Omani company law. You can also read Decree’s Intel on the link below for an Overview of Types of Companies in Oman:

Written by:

Abdulrahman Al-Farsi

Abdulrahman Al-Farsi is a Junior Legal Researcher at Decree and a Final Year Law Student at the University of Liverpool.

First of all, the executive regulation did not provide any exemptions for the requirement to identify a personal data protection officer. This means that all organisations, irrespective of size, industry, the type of data they process, the amount of data they process, or the number of data subjects they interact with, are required to identify a personal data protection officer as long as the law applies to them.

The executive regulation used the same language used by the law, which is the requirement to “identify” a personal data protection officer, and not “appoint”, which we understand to mean that the position of the “personal data protection officer” does not have to be a standalone full-time job, but it can be a role assigned to an existing employee who might or might not be carrying out similar functions (for example, compliance in general) as long as the employee meets the requirements stipulated by executive regulation.

Article 34 of the executive regulation stipulates the requirements for the personal data protection officer, which are that he is qualified to carry out the tasks stipulated in the regulation, that he is familiar with the law and the personal data protection practices of the controller, and that he is of professional competence. There are no requirements for any specific certification or academic or professional past experience.

The actual duties of the personal data protection officer are stipulated in article 35 of the executive regulation, which can be summarised as being responsible for giving advice to the controller, monitoring the implementation of data protection policies, monitoring the implementation of the law and the regulation, and coordinating with the Ministry of Transport, Communications, and Information Technology in matters relating to the processing of personal data.

The controller is required to publish the name and contact details of the personal data protection officer to enable data subjects to contact him.

You can read the Personal Data Protection Law as well as its newly issued executive regulations in full in English on the links below:

Written by:

Aram Al-Bahri

Aram Al-Bahri is a Legal Associate at Decree. She holds an LLB Law Degree from the University of Leeds. She works in the area of labour and corporate law and has expertise in the field of policymaking.

The Personal Data Protection Law and its executive regulation do not have a definition for “sensitive data”, but article 5 of the law stipulates that it is prohibited to process “genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or those relating to security measures” without obtaining a permit from the Ministry of Transport, Communications, and Information Technology (MTCIT).

The new Executive Regulation of the Personal Data Protection Law that came out earlier this week clarified how this process takes place. According to article 5 of the regulation, the controller must fill out a form in accordance with the requirements set out by the MTCIT including providing the purpose for processing personal data and the places to which personal data will be transported or stored. Additionally, the controller must submit both their privacy policy and the precautionary measures adopted by him in case of a personal data breach, as per article 6 of the regulation.

Following the submission of the application, the MTCIT will review the application and decide on it within 45 days. If the application is rejected by the MTCIT, justification must be provided. The application is also automatically rejected if the 45 days period lapses without a response. If the application is rejected, the applicant has the option to file a grievance with the Ministry of Transport, Communications, and Information Technology. Again, if there is no response to the grievance within 30 days of its submission, it is deemed rejected.

If the application is approved, the minister may grant the permit for up to 5 years. Any amendments to the permit details must be informed to the MTCIT within 15 days. In terms of renewal, the permit can be renewed for equivalent durations using the same procedures outlined in this blog.

You can read more about the conditions for processing personal data under the Personal Data Protection Law and its executive regulation on the links below:

Written by:

Iman Al-Lawati

Iman Al Lawati is a legal intern at Decree and a recent LLB Law graduate from the University of Leeds. Prior to joining Decree, Iman trained in private practice and non-profits, gaining experience across corporate, commercial, immigration and criminal law sectors. She has an interest in corporate and commercial law, as well as the integration of technology in the legal field.

The rights of data subjects are stipulated in article 11 of the Personal Data Protection Law, which are (1) the right to revoke the consent to processing personal data; (2) the right to request to have one’s personal data amended, updated, or blocked; (3) the right to obtain a copy of one’s processed personal data; (4) the right to transfer one’s personal data to another controller; (5) the right to request the erasure of one’s personal data; and (6) the right to be notified of a breach involving one’s personal data.

The Executive Regulation of the Personal Data Protection Law has clarified that requests by a data subject to a data controller to enforce these rights must be fulfilled free of charge within a period of 45 days.

The executive regulation also provides restrictions on the right to request the erasure of one’s personal data, i.e. the right to be forgotten, by stipulating that this right can only be exercised in the cases provided in article 18 such as requesting the data to be erased when the purpose of the processing ends.

The right to obtain a copy of the processed personal data has also been detailed in article 19 of the executive regulation which states that the data subject has the right to request from the controller the data in a readable and clear electronic or paper format, provided that this data does not include any personal data of third parties.

The executive regulation allows the controller to refuse to fulfil requests by a data subject on a number of grounds. In regard to all data subject requests, article 17 permits the data controller to deny the request if the request is unjustifiably repetitive or if its implementation requires extraordinary effort. Furthermore, article 18 provides grounds for refusing erasure requests in particular, which are cases where a legal obligation is imposed on the controller by virtue of any law or court judgment, or if there is an ongoing dispute between the controller and the data subject.

The executive regulation gives data subjects the right to complain to the Ministry of Transport, Communications, and Information Technology (MTCIT) of any violation committed, including those by a data controller in regard to a data subject right. Under article 41, the complaint must be filed within 30 days from the date of learning of the violation. Under article 43, the MTCIT can take up to 60 days to respond to the complaint, and if the MTCIT does not respond within this time period, the complaint is deemed rejected.

The new details found in the Executive Regulation of the Personal Data Protection Law provide further clarifications on the nature and limitations of the data subject rights. However, individuals must be aware of the time limits associated with complaints to be able to enforce these rights against data controllers.

You can read the Personal Data Protection Law as well as its newly issued executive regulations in full in English on the links below:

Written by:

Mohammed Al-Farsi

Mohammed Al-Farsi is a Legal Associate at Decree. He holds an LLB Law Degree from the University of Exeter. Prior to joining Decree, Mohammed trained in the oil and gas sector, private practice, and in a regional tech company. He has an interest in corporate and commercial law.

At the outset, article 11 of the Personal Data Protection Law stipulates that data subjects enjoy the right to be notified of any breach or infringement of their personal data, and also of the actions taken in regard to such breaches. Article 19 of the law imposes a corresponding obligation on the data controller to report data breaches to both the data subject and the Ministry of Transport, Communications, and Information Technology (MTCIT). Failure to comply with this obligation is punishable by a fine ranging between 15,000 Rial Omani and 20,000 Rial Omani.

The newly issued Executive Regulation of the Personal Data Protection Law has introduced several new provisions that outline in detail the obligations of data controllers as well as the rights of data subjects in regard to data breaches. First of all, data controllers wishing to apply for a permit to process sensitive data are required to include in their application the precautionary measures they adopt in the event of a data breach. Both data controllers and data processors are also required to keep a record of all data breaches they experience in a special register along with the facts surrounding the breach, its effects, and the actions taken in regard to them.

Secondly, the executive regulation sets the deadline for reporting a breach to the MTCIT at 72 hours from the time of knowledge of the breach if the breach is capable of leading to a risk that threatens the rights of data subjects. We understand this to mean that data breaches that do not have an impact on personal data do not have to be notified to the MTCIT. Article 30 of the regulation provides in detail the information that needs to be included in the data breach notification to be sent to the MTCIT.

Once notified, the MTCIT has the right under article 31 of the executive regulation to evaluate the procedures undertaken by the controller, to order him to notify data subjects of the breach, and to provide guidance and support to the data controller.

In all cases, the data controller also has a separate obligation to notify the data subject of a data breach within 72 hours of his knowledge of it, if such breach is capable of causing serious harm or high risk to the data subject. We understand this to mean that breaches that are not expected to cause serious harm to a data subject do not need to be notified to the data subject.

The new provisions found in the Executive Regulation of the Personal Data Protection Law are a welcome addition for clarifying many of the provisions found in the law, and they would hopefully contribute to increasing the level of protection afforded to users in Oman.

You can read the Personal Data Protection Law as well as its newly issued executive regulations in full in English on the links below:

Written by:

Rayan Al-Habsi

Rayan is a legal intern at Decree and a recent LLB law graduate from the University of Nottingham. Prior to joining Decree, Rayan trained in corporate and commercial sectors. She has an interest in corporate, renewables, and CSR, as well as technological incorporations into the legal field.