Who can form one, and with what

Under article 234 of the Commercial Companies Law, an LLC is formed by no fewer than two and no more than 50 persons, natural or legal, and each of them is liable for the company’s debts only up to the value of their shares. If there is only one owner, article 291 provides a separate but closely related vehicle, the one-person company, which is in substance an LLC with a single shareholder. A natural person may own only one of these, so a founder cannot spin up a separate one-person company for every venture.

Under the law, the name of the company can be the shareholder’s name or any word or phrase, provided it does not mislead as to the company’s objectives or the identity of its owners, and requires that wherever the name appears it is followed by “limited liability company” or “LLC”. Check availability with the Ministry of Commerce, Industry, and Investment Promotion before settling on anything, under article 40, a registered name cannot be used by another merchant in the same line of business, though two companies in genuinely different fields can carry similar names.

In terms of capital, it is divided into shares of equal value. Article 239 allows contributions in cash or in kind, but not in services or labour, because founders often plan for one partner to contribute effort rather than money. That works in a partnership. It does not work in an LLC. However, where a contribution is in kind, article 242 requires its type, location, and value to be set out in a report prepared by a valuation office or an auditor licensed in Oman, and if the value turns out to have been inflated, the contributing shareholder must pay the difference to the company in cash out of his own pocket.

Getting registered

Once the shareholders have settled the constitutive documents, they have 30 days to apply to register the company with the Registrar. The application goes through the Ministry’s electronic system, and article 87 of the Commercial Companies Regulation requires it to be accompanied by the constitutive contract, the minutes of the partners’ meeting where one of the partners is a legal person, and identity documents for the partners and managers. Any later amendment to the constitutive documents follows the same route within the same 30 days.

The constitutive contract must contain:

• The name and principal place of business.
• The capital and the breakdown between cash and in-kind shares.
• The shareholders with their nationalities and shareholdings.
• The company’s objectives, its date of establishment and duration.
• The manager’s name and powers.
• The start and end of the financial year.
• The body that will resolve disputes between the shareholders.
• The majorities needed to pass resolutions at the shareholders’ meeting.

These constitutive documents must all be written in Arabic; otherwise, they are considered void. The company then acquires legal personality only from the date of its registration, so anyone who does business in the company’s name before that point is personally liable for the obligations he creates.

If one of the shareholders is not Omani

Under the Foreign Capital Investment Law, no foreigner may carry out an investment activity in Oman except after obtaining a licence from the Ministry of Commerce, Industry, and Investment Promotion. Article 12bis of its executive regulation also requires the company to appoint at least one Omani worker no longer than a year from the start of its commercial activity, to register that worker with the Social Protection Fund, and to comply with the Omanisation percentages if set for its sector.

Running the company

For the company, the management is entrusted to one or more managers who must be natural persons, drawn from the shareholders or from outside, and appointed either in the constitutive documents or by a resolution of the shareholders. Removing a manager requires a resolution of shareholders owning three quarters of the capital, and that same resolution must appoint his replacement, so the shareholders cannot vote a manager out and leave the seat empty.

Ten per cent of the company’s net profits each year must be set aside by the managers, after tax, into a legal reserve, and to keep doing so until that reserve reaches one third of the capital. It cannot be paid out as dividends; it exists to absorb accumulated losses.

An auditor plays a huge role in an LLC, but not every LLC needs one. They are only needed when a company has more than seven shareholders, when its capital exceeds 50,000 Rial Omani, when the constitutive documents call for one, or when its shareholders representing at least a fifth of the capital ask for one. A small company starting out will often fall outside all four, though it will still need audited accounts for tax purposes.

Things to keep in mind for later

Shares in an LLC are not tradable, so bringing in a new partner means transferring existing shares, and the other shareholders have a right of pre-emption which they may exercise within 45 days by depositing the full price. Increasing or reducing the capital requires a unanimous shareholder resolution, and a reduction gives creditors 30 days to object. Once the first financial year closes, a reporting cycle begins. The managers have 90 days to prepare the financial statements, and 180 days from the year-end to circulate them to the shareholders with the notice of the meeting that approves them. Filing obligations also continue past incorporation since resolutions and records must reach the Ministry of Commerce, Industry, and Investment Promotion within seven days, and the company has seven working days to produce audited financial statements when the ministry asks for them.

In short

An LLC is not difficult to set up in Oman, but the protection it offers is conditional on doing a handful of things properly. When setting up a company, it is always good to check the Commercial Companies Law and understand all requirements that apply to you depending on your size or the type of establishment.

You can read the Commercial Companies Law in full in English at the link below:

Written by:

Abdulrahman Al-Farsi

Abdulrahman Al-Farsi is Legal Associate and Board Secretary at Decree. He holds an LLB from the University of Liverpool and had previously worked in an Omani law firm.

Trial by Expert Report: The Court Method     

According to article 82 of the Law of Evidence in Civil and Commercial Transactions, the court is permitted either on its own motion or at the request of a party to call in an expert to investigate a certain matter or give an opinion on a specialised or technical question. Article 103 explicitly stipulates that the opinion of the expert does not bind the court, meaning that the role of the expert remains advisory. Articles 101 and 104 give the parties the means to discuss, object to, or request an additional or substituted report.

While the court may select an expert from the lists compiled by the Ministry of Justice and Legal Affairs, the court is not bound by this list and can use an expert agreed by the parties.

The Expert is the Decision-Maker: The Arbitration Method

The Law of Arbitration in Civil and Commercial Disputes does not require an arbitrator to be a lawyer or a judge and gives the parties total control regarding the number of arbitrators and method of selection. Pieced together, this means that the parties may place a construction project manager, an oil and gas engineer, or a software developer directly as an arbitrator on the tribunal and not as an expert witness.

Furthermore, even where a tribunal appoints its own expert, article 36(4) still permits each party to bring in their own expert to directly respond to said report in a hearing rather than a written objection filed for a judge to weigh later.

Which Path to Take?

When it comes to a contract where the dispute is of a technical nature instead of being purely legal, it is important to consider the importance of involving a subject matter expert in the actual decision-making process of the outcome.

If the technical expertise is very significant to understanding the issues at hand and resolving the dispute, using arbitration instead of litigation can be very useful, since the arbitration clause can explicitly stipulate the qualifications and criteria for the arbitrator or arbitrators who will resolve the dispute, which the parties can agree at the time of drafting the contract for the underlying deal.

Conclusion

Both litigation and arbitration have their approaches for dealing with matters of a highly technical nature. The courts can refer the matter to an expert who prepares an advisory report, while arbitration gives the parties the autonomy to select a subject matter expert as a member of the arbitral tribunal if they wish.The parties to the dispute need to weigh the pros and cons of each approach and make a conscious decision of the path they wish to take by drafting a clear and explicit dispute resolution clause in their contracts.

Written by:

Malak Al Kharusi

Malak is a legal intern at Decree. She has previously interned in the government sector. She is interested in commercial law. She is about to start the final year of her Business Management and Law degree at Leeds Beckett University.

The Personal Data Protection Law (Royal Decree No. 6/2022) has been in force since February 2023. It is Oman’s first comprehensive data protection statute, and a clear step forward from the single chapter of the Electronic Transactions Law that previously governed the field. Across its 32 articles, the PDPL grants data subjects a genuine set of rights and places clear obligations on controllers, giving the Sultanate a solid foundation to build on.

This policy brief examines that framework through the lens of data subject rights and identifies three areas where targeted refinement would strengthen it. First, the right of access could be broadened so that a copy of one’s data comes with the context needed to judge how it is being used. Second, a limited set of lawful bases could sit alongside consent, freeing consent to do its real work of protecting higher-risk processing. Third, a personal route to compensation could run alongside the Ministry’s enforcement role. Drawing on comparators including the UK GDPR and the Saudi and UAE frameworks, each reform builds on what the PDPL already does rather than reworking it.

As Oman Vision 2040 drives the growth of digital government, e-commerce, and cloud-based enterprise, individuals are increasingly asked to share their data to reach everyday services. Robust data subject rights are what allow them to take part in that digital future with confidence rather than exposure, making the case for reform both timely and central to the Sultanate’s wider economic ambitions.

Introduction

We live in an era where individuals constantly hand over sensitive information to organisations, often without knowing how it will be used, by whom, or for how long. Personal data has become an economic input for countless organisations, and while this has driven real benefits, in the form of more efficient markets and more responsive public services, the risks that come with it cannot be ignored.

The Basic Statute of the Sultanate of Oman already recognises the importance of personal privacy, establishing the inviolability of private life in Article 36. The Omani legislator went further with the Personal Data Protection Law (PDPL), issued by Royal Decree 6/2022 on 9 February 2022 and entering into force a year later. It is Oman’s first comprehensive piece of legislation dedicated to personal data protection, repealing and replacing Chapter 7 of the Electronic Transactions Law (Royal Decree 69/2008), which had governed the subject only in limited terms.

The PDPL runs to 32 articles, the first of which defines the key terms used throughout. It grants a set of rights to the data subject, the natural person identifiable through their personal data, and imposes obligations on the controller, who processes personal data or entrusts a processor to do so on the controller’s behalf. The processor, in turn, carries its own obligations under the law. The PDPL is supplemented by Executive Regulations issued under Ministerial Decision 34/2024, which fill in the detail the primary legislation left for the regulations to specify.

This brief looks at Omani law through the lens of the data subject. The first section sets out the rights the PDPL grants to data subjects, the second looks at where Omani law falls short against leading international standards, and the third sets out reforms to close those gaps.

What Rights Does the PDPL Give Data Subjects?

The PDPL grants data subjects six core rights under Article 11, but their practical strength varies considerably: some are stated in absolute terms, others depend on procedural detail the law defers elsewhere, and at least one presupposes a right the law does not clearly grant. Assessing that variation, rather than simply listing the rights, is the task of this section and the critiques that follow.

The rights granted to data subjects sit at the centre of any data protection framework, and the PDPL builds its own around a single gatekeeping requirement: personal data can only be processed after the data subject has given explicit, written consent. The law treats that consent as the operative condition for everything else, so the rights that follow are largely conditioned on it.

Article 11(a) gives the data subject the right to withdraw consent, bringing the processing relationship to an end. Article 11(b) lets the data subject ask for their data to be updated, amended, or blocked. Article 11(c) establishes the right of access, which matters because, without it, a data subject has no way to check whether their data is accurate or whether the controller has processed it beyond its original purpose (the Executive Regulations add procedural detail here). Article 11(d) grants a right to data portability, the transfer of one’s data to another controller, putting Oman among a small number of jurisdictions to grant a right of this kind. Article 11(e) grants the right to request erasure, subject to one exception for data processed for national archiving purposes. Finally, Article 11(f) entitles a data subject to be notified of any breach affecting their data, along with the action taken in response. Article 11 itself does not set out the procedures for exercising these rights; that detail, again, is left to the Executive Regulations.

Beyond Article 11, Article 12 gives data subjects a route to complain to the Ministry (MTCIT) where they believe their data has been processed unlawfully. The PDPL also imposes obligations on controllers that indirectly reinforce these rights, even though they are not framed as data subject rights themselves: Article 21 requires controllers to keep personal data confidential, Article 22 requires separate written consent before data is used for commercial or marketing purposes, and Article 23 prohibits cross-border transfers that are unlawful or that would harm the data subject.

Where the PDPL Falls Short for Data Subjects

A Right of Access That Doesn’t Go Far Enough

The right of access matters because it lets data subjects work out whether their data is being processed lawfully, and whether they need to exercise any of their other rights. But Article 11(c) of the PDPL only gives data subjects the right to obtain a copy of the personal data being processed. Article 11 also gives rights to amendment, blocking, erasure, and portability, but none of these oblige a controller to explain the broader context in which the data is being processed; those procedures, too, are left to the Executive Regulations.

Compare this with Article 15 of the UK GDPR, which treats access as extending well beyond the data itself. A controller responding to a UK access request must also disclose the purpose of processing, the categories of data involved, the recipients the data has been shared with, the envisaged retention period, the source of the data where it wasn’t obtained from the individual directly, and information about any automated decision-making. These requirements give data subjects what they need to judge whether processing is lawful, understand how their data is being used and shared, and decide whether to exercise their other rights.

This gap matters because several data subject rights turn on information a copy of the data alone won’t reveal. That copy won’t show whether data has been kept longer than necessary, shared with third parties, or used for a purpose it was never collected for: exactly the kind of thing Article 15 of the UK GDPR is designed to expose, and which might justify seeking reassurance, restriction, or objection. Article 12 of the GDPR reinforces this by requiring controllers to make it easy for data subjects to exercise their rights, and to provide information in a concise, transparent, and accessible form. Together, Articles 12 and 15 turn access from a simple entitlement to information into a practical tool that individuals can use to scrutinise how their data is handled. Oman’s narrower approach gives data subjects considerably less transparency over processing, and leaves them with a heavier burden: without that wider picture, spotting non-compliance becomes much harder.

Consent as the Only Lawful Basis

Article 11 of the PDPL makes unambiguous consent the general requirement for processing personal data, and the Executive Regulations (Ministerial Decision 34/2024) set out what that means in practice: consent must be freely given, not forced, given by a person with full legal capacity, and recorded in a form the controller determines, whether in writing or electronically. The law does carve out a small number of situations where consent isn’t required, namely meeting a legal obligation, protecting vital interests, and performing a contract to which the data subject is a party. These are exceptions to the consent requirement rather than alternative lawful bases in their own right, and the distinction matters: a controller falling outside these narrow exceptions has no basis to process data at all, while a data subject has no equivalent right to object to processing that does fall within them.

The comparison with other jurisdictions is telling. The UK GDPR sets out six lawful bases in Article 6, of which consent is only one; it pairs legitimate interests with a mandatory balancing test and gives individuals a right to object under Article 21, so people retain some control even where consent was never sought or given. The UAE’s Federal Decree-Law 45/2021 also recognises grounds beyond consent, including contractual necessity, legal obligation, and the legitimate interests of the controller. Most instructive of all is Saudi Arabia, whose Personal Data Protection Law (PDPL) began life just as consent-centric as Oman’s, before it was amended in 2023 to add legitimate interest as a standalone lawful basis, specifically because the original, consent-only draft proved unworkable for ordinary commercial processing. A regional peer identified the same flaw in its own law, and fixed it through legislation.

Oman’s consent-only structure creates two problems, and both work against the data subject rather than for them. First, requiring consent even for low-risk, routine, and entirely expected processing pushes controllers towards obtaining broad, bundled consent at the very start of a relationship, consent that may be formally valid but is meaningless in substance. Consent given as the price of receiving a service isn’t meaningfully free, and a system that demands consent for everything ends up producing consent worth having for nothing. Second, because the law has no general right to object, the only real control a data subject has is to withdraw a consent that was never truly voluntary to begin with; withdrawing consent for a service you still need is not much of a choice at all.

No Right to Compensation

On paper, the PDPL protects data subjects well. But when a violation actually causes harm, the law sends the data subject to the regulator rather than to a remedy of their own. The Ministry of Transport, Communications and Information Technology (MTCIT) controls enforcement, with the power to fine a controller or pursue criminal sanctions, a deliberate design choice that gives the regulator clear, centralised authority. Where the law falls short is that it gives individuals no direct route to compensation. A data subject can complain to the Ministry under Article 12, but that is their only channel: they have no standing to bring a controller before a court, no independent adjudicator sitting above the regulator, and no way to have a judge rule on whether their rights have been breached. If the Ministry chooses not to act, or simply doesn’t respond, the data subject’s options run out there.

That gap is felt most sharply where the harm is non-material: the distress of losing control of your data, reputational damage, or the exposure of sensitive details. In those cases, a data subject can be left with no personal remedy even where the Ministry does fine the controller. A fine serves the public interest in compliance; it does nothing to make the injured individual whole, and the two are not the same thing. For a law built around protecting the individual, that is a gap worth closing, and not an unusual one to close either: the GDPR and Brazil’s LGPD (Article 42) both give data subjects a direct route to compensation, showing this is a broadly accepted standard rather than a regional one.

Under Article 82 of the GDPR, a person can claim compensation directly from a controller for both material and non-material damage, and Article 79 gives them an effective judicial remedy against that controller on top of any complaint to the regulator. The Court of Justice of the European Union confirmed that this right has real substance: in Case C-300/21 (2023), it held that non-material harm doesn’t need to cross any threshold of seriousness to qualify, though a claimant must still show real damage and a causal link, not merely a breach. Saudi Arabia’s own PDPL takes the same approach: Article 40 lets anyone who suffers damage apply to a competent court for proportionate compensation for material or moral harm, moral harm being exactly the emotional and reputational injury at issue here, and that claim runs independently of any penalty the regulator imposes. The value of the court route isn’t only the payout: it puts an independent judge, rather than the regulator alone, in charge of deciding whether a person’s rights were actually breached.

A recent breach shows why the type of remedy matters. In May 2026, the Canvas learning platform, operated by Instructure, was hacked, exposing the personal data of students across thousands of institutions. The incident was resolved through a private settlement between the company and the attackers, not through any payment to the people whose data was exposed. Cases like this raise a hard question: what remedy should a data subject have when the processor wasn’t obviously at fault? The answer depends on the model. The GDPR’s liability is fault-based: Article 82(3) lets a controller or processor escape compensation if it proves it bears no responsibility for the event that caused the harm, meaning a genuinely blameless processor might avoid paying regardless.

Closing the Gaps: Reforms Centred on the Data Subject

A Right of Access Worth Having

Oman should strengthen the right of access by amending Article 11(c), or the Executive Regulations made under it, so that a copy of personal data comes with the context needed to make that right meaningful. Alongside the data itself, controllers should have to disclose the purpose of processing, the specific recipients, the applicable retention period, the source of the data where it wasn’t obtained from the data subject, and information about any automated decision-making, bringing Oman in line with Article 15 of the UK GDPR.

This matters most in the context of automated decision-making, where people can’t meaningfully assess or challenge a decision without understanding how it was reached. According to the Business and Human Rights Centre, Uber and Ola drivers in the Netherlands couldn’t challenge algorithmic dismissals until the courts confirmed that Article 15(1)(h) of the GDPR entitled them to information about the logic behind decisions that had ended their employment. An Omani worker facing an equivalent automated dismissal would currently have no comparable right. The UAE PDPL recognises a right to object to automated processing, while Saudi Arabia’s PDPL separately requires controllers to inform data subjects of the purpose and legal basis of data collection under Article 4. Neither, however, requires disclosure of the logic underlying automated decisions, so adopting the GDPR’s broader disclosure requirements would place Oman ahead of both regional counterparts.

Importantly, this reform could be implemented through the Executive Regulations rather than the primary legislation, making it one of the more practical recommendations in this brief: amending regulations is generally quicker, and less politically demanding, than amending a statute.

A Right to Compensation and Judicial Remedy

Oman’s framework is a strong foundation, and the fixes needed here are refinements rather than an overhaul. Following Saudi Arabia’s Article 40, and reinforced by Articles 79 and 82 of the GDPR, the law should give data subjects an express right to claim compensation before a competent court for both material and moral harm. That right should run alongside the Ministry’s existing enforcement powers, not replace them. The advantage of this approach is that it builds on rights Oman already has, while keeping the Ministry’s role intact and adding a personal remedy on top. The trade-off is that a court route adds cost and litigation risk for controllers, and requires the slower process of legislative change to put in place.

Oman would also do well to adopt a fault-based system of liability, along the lines of Article 82(3) of the GDPR: if a controller can prove it is not responsible for a violation, it should not have to compensate those affected by it. This offers an answer to the Canvas problem. Where there is no clear evidence that a processor caused or contributed to a violation, the appropriate course is to test whether it was negligent, or otherwise responsible, through a judicial process. Finally, limiting the amount of compensation a controller must pay, as Saudi Arabia’s Article 40 requires, would guard against a “floodgate” situation: controllers would still face real liability, but it would be limited and quantifiable rather than unlimited and unquantifiable.

Beyond Consent: A Safer Lawful Basis

Oman’s reform here should follow the Saudi model. Adding legitimate interests and contractual necessity as affirmative lawful bases, subject to a documented balancing assessment, would take the pressure off consent and let it function as a genuine safeguard for processing that is actually high-risk. The advantages are practical: controllers could manage fraud detection, network security, internal administration, and debt recovery without needing consent that no data subject would meaningfully refuse anyway, freeing enforcement resources to focus on processing that genuinely threatens people’s interests.

The risks, though, are real. Legitimate interest is a flexible standard, assessed by controllers themselves, and European experience shows how far it can be stretched: Meta tried to justify behavioural advertising first as a contractual necessity and then as a legitimate interest, and both arguments were rejected by the European Data Protection Board and the Court of Justice of the European Union. That example is an argument for safeguards rather than against reform: an obligatory, documented legitimate interest assessment, of the kind the UK Information Commissioner’s Office requires and opens to regulatory review, paired with a general right to object under Article 21 of the UK GDPR, would let Oman widen its lawful bases without leaving the data subject any less protected.

Why This Matters for Oman’s Digital Future

Protecting data subject rights is not a footnote to Oman’s digital transformation; it is central to it. As Oman Vision 2040 pushes digital government services, e-commerce, and cloud-based enterprise, ordinary people are increasingly required to hand over personal information to access basic services, often with little visibility into how that data is stored, used, or shared. Meaningful data subject rights, access, correction, erasure, and the ability to withdraw consent, give people real control over that exposure, rather than leaving them dependent on the goodwill of controllers. Without those protections, the same digital economy that Vision 2040 is built on becomes a source of risk rather than opportunity, through data misuse, breaches, and unauthorised disclosure. Strong data subject rights are what let people take part in Oman’s digital future with confidence, rather than vulnerability.

Conclusion

This brief began from a simple proposition: the PDPL exists to balance the interests of individuals who disclose their personal information against those of the organisations that control how it is processed. Before 2022, personal data in Oman was governed by a single chapter of the Electronic Transactions Law; today, it has a dedicated law built around it.

The gaps set out above, around access, consent, and remedies, show where that law still falls short for data subjects. The reforms proposed here would close them, giving data subjects real, usable protection over their own personal data.

Oman has pursued the digital economy as a central plank of Oman Vision 2040, treating it as a key tool for economic diversification away from hydrocarbon revenues. That pursuit has brought with it an expansion of digital government services, telecommunications, and cloud-based enterprise, and, with it, a corresponding rise in the processing of personal data, along with the risks that come with it: misuse, breaches, and unauthorised disclosure by the organisations entrusted with sensitive information. Protecting data subject rights should not be treated as secondary to a thriving Omani economy; the two go hand in hand.

Authors

Aatika Al-Hinai
Queen Mary University of London, United Kingdom

—

Mais Al-Hajri
Sultan Qaboos University, Oman

—

Malak Al-Kharusi
Leeds Beckett University, United Kingdom

—

Mohammed Al-Lawati
University of Liverpool, United Kingdom

—

What an ITC actually is

ITC’s are essentially designated areas which the government has allocated specifically for tourism and residential developments. Article 1 of the Executive Regulation of the System of the Ownership of Real Estate in Integrated Tourism Complexes sets out a more extensive definition of ITC’s. Qualifying as an ITC, however, is not automatic. Article 5 of the executive regulation lays out the licensing requirements, and some of them are more specific than buyers might expect. A complex must sit on at least 200,000 square metres of land, suited to commercial, residential, or touristic use, and the developer must first secure preliminary plans approved by both the Ministry of Tourism and the Governmental Licensing Committee. Other conditions are less expected: the site must be at least 20 kilometres from Oman’s international border, non-touristic real estate cannot exceed half the land used for construction, and, perhaps most tellingly, the number of residential units in the complex can never exceed the number of hotel units. An ITC, by design, has to remain a tourism project first and a residential one second. This does not mean every unit has to look like a resort. Ordinary residential real estate can account for as much as half of an ITC’s built area, so buyers can find standard homes and apartments within these zones, not just hotel-style properties.

Buying inside vs outside an ITC

Outside an ITC, the default rule is restrictive. In 2018, Royal Decree 29/2018 issued a law prohibiting non-Omanis owning land and real estate in certain areas. This includes entire governorates, specific wilayats, islands, and land near military and archaeological sites. Integrated Tourism Complexes are the deliberate exception to that rule. Any sale, transfer, or other ownership made in breach of law is void from the outset. Anyone affected can demand its nullification, and under article 9, the court must rule on it even if neither party raised the issue, meaning the prohibition cannot be quietly bypassed by agreement between the parties. Violations carry imprisonment of 3 months to 2 years and fines between 1,000 and 5,000 Rial Omani under article 10, with the higher penalties applying where fraud is involved. Inside a licensed ITC, none of this applies. Non-Omani owners can be granted residency for themselves and their immediate family, an initial two-year term that renews automatically in six-year cycles for as long as they hold the property. That certainty, however, still depends on getting the registration right.

Where the new Registry Law fits in

Registration in Oman is no longer the same process it was a year ago. As of May 2026, that process now runs through the Real Estate Registry Law of 2026. To prove ownership of land under the Real Estate Registry Law, an individual needs an official paper or electronic document issued by the ministry, known as the mulkiya. It is the only proof of ownership recognised by law, signed and issued by the Secretariat of the Real Estate Registry. This applies to non-Omani buyers too. Article 12 expressly permits registrations in the name of non-Omanis or legal persons, in accordance with the laws governing ownership eligibility, meaning the ITC system covered earlier. Yet none of this applies unless the underlying transaction is registered in the first place. Article 10 makes clear that any disposition creating or transferring a real estate right, including court judgments, has no effect beyond a personal obligation between the two parties unless it is registered, an unregistered sale does not bind anyone else. The system also has teeth against fraud: obtaining registration through falsified documents now carries up to three years imprisonment and fines reaching 30,000 Rial Omani.

Due diligence

Before paying anything, buyers should confirm the development is a genuinely licensed ITC, and not simply marketed as one, since that status requires government approval and specific licensing criteria. Additionally, buyers are encouraged to ensure the developer holds a valid licence under the Law Regulating Real Estate, and that the transaction is actually being registered with the Secretariat of the Real Estate Registry, with the mulkiya issued as proof. For pre-construction purchases, this means confirming registration in the Preliminary Real Estate Registry rather than relying on a private sale agreement alone. Buying property in Oman as a foreigner comes down to two questions: is this an ITC, and is it properly registered. Get both right, and the rest of the process is straightforward.

While ITCs remain the primary path for foreigners to buy property in Oman, it is worth noting that the Law of Special Economic Zones and Free Zones of 2025 creates a new parallel framework for creating free-hold residential projects in which foreigners are permitted to own projects, but no such projects are available in the market until now.

For further detail on Integrated Tourism Complexes, the full text of the System is linked below.

Written by:

Zayd Al Harrasi

Zayd is a legal intern at Decree. He is interested in corporate, commercial, and company law. He is about to start the final year of his Business Law Degree at Nottingham Trent University.

Artificial intelligence has advanced significantly in recent years. AI systems can now generate text, compose music, and create images and other works. These advancements have also raised significant legal concerns, particularly regarding intellectual property rights. AI developers often use copyrighted materials to train AI models, raising the risk that these models will create counterfeit or derivative works belonging to other people. This issue has not yet been addressed under Omani law: there is no specific legal provision or regulation governing the relationship between AI and intellectual property. By contrast, jurisdictions such as the United Kingdom, the United States, and the European Union have already begun to grapple with the problem and to explore potential solutions. Oman should therefore begin addressing this issue, drawing on the experience of these jurisdictions to inform its own approach.

The connection between artificial intelligence and intellectual property arises from AI’s growing capacity to create works similar to those made by human artists, such as images and music. This capacity makes it easier to reproduce the works of well-known artists and imitate their distinctive styles, raising the question of whether such conduct amounts to intellectual property theft or should instead be regarded as merely drawing inspiration from existing works.

The Omani Legal Framework

When examining Omani law at the intersection of artificial intelligence and intellectual property, the most prominent issue is the infringement of intellectual property rights by AI, and how such infringement, though contrary to law and ethics, has become so simplified and widely accessible that it is now available to anyone with the click of a button. This section examines how Omani law treats AI activities that rely on imitating or using copyrighted materials, guided by a single question: does Omani law treat the training of AI systems on copyrighted material as a violation of the law, or as a permissible exception?

Training an AI system involves compiling a large database of the data on which the model is trained, including words, letters, shapes, patterns, and colours, drawn from sources such as websites, books, articles, images, videos, music, and other works. Once this data is collected, it is presented to the system, which learns to recognise statistical patterns in it, analyse them, and generate similar patterns or predict the most likely next one through repeated exposure. Since this process requires assembling a dedicated database, the developer must first identify the data to include, download or copy it, and then store that copy electronically for later use in generating derivative outputs.

These steps matter because the Copyright and Neighbouring Rights Law, reserves the economic rights in a work to its author. Article 6 grants the author the right to reproduce the work, one of the most significant rights the law protects, as well as the right to adapt it into other forms, create derivative works, and dispose of the work in both its original and copied forms. Article 1 defines reproduction broadly as making one or more copies identical to the original, whether directly or indirectly, “by any means such as printing, photocopying, recording, or permanent or temporary electronic storage.” This definition captures precisely what AI training involves: the electronic storage of copyrighted works, a step that is fundamental to building a training database but is reserved exclusively to the author unless the author grants that right to another party by agreement.

There are, in principle, two ways an AI developer might avoid infringing copyright in this process. The first is to obtain the author’s consent to use the work for training purposes; although the law does not address this scenario explicitly, such permission would, as in other contexts, allow the work to be used lawfully. The second is for the training process to fall within Chapter Five of the law, which sets out the free uses of works. Article 20 lists uses that do not require the author’s consent, including use for explanation or critique, educational and informational purposes, copying by archives or public libraries, and use to illustrate a concept in a study, provided that certain conditions relating to the quantity used, the manner of use, and the absence of any direct or indirect financial gain are met. Article 20 makes no mention of AI or its training on copyrighted material. We therefore conclude that training an AI system without the author’s permission, and without relying on works in the public domain, constitutes a clear violation of copyright under Omani law. This gap, the complete absence of any law or regulation addressing AI’s use of copyrighted material, creates considerable uncertainty about how Omani law will respond to these issues as the technology continues to advance.

Comparison with Other Jurisdictions

The European Union offers a significant comparative model for Oman, having been the first jurisdiction to establish a comprehensive legal framework for artificial intelligence through the Artificial Intelligence Act (Regulation (EU) 2024/1689). The Act creates a framework intended to build trust in AI technology while protecting human rights and safety. Although it permits text and data mining for the training of general-purpose AI (GPAI) systems, this mechanism is subject to strict conditions and does not give AI developers a free pass to use copyrighted data. The Act requires generative AI providers to comply with existing EU copyright law, imposes transparency obligations regarding the content used to train AI models, and gives rights holders the option to opt out of having their content used for training.

Because GPAI providers require large datasets that may contain copyrighted material, questions arise over whether such use might constitute infringement. The EU addresses this largely through Directive (EU) 2019/790 on Copyright in the Digital Single Market, which introduced text and data mining exceptions under Articles 3 and 4. Article 3 permits research organisations to use protected content lawfully but excludes commercial or industrial uses. Article 4 allows other institutions to reproduce and extract data, subject to an opt-out mechanism that allows rights holders to exclude their work by ‘machine-readable’ means. What qualifies as machine-readable has been contested, notably in the German case Kneschke v LAION, in which a non-profit organisation used Kneschke’s copyrighted content to build an AI training dataset. The court rejected the copyright claim on the basis that the use fell within the text and data mining exception for scientific research, and held that a reservation expressed only in ordinary language was not sufficiently machine-readable. An appeal is pending.

Article 53(1)(d) of the Act further requires generative AI providers to publish a sufficiently detailed summary of the content used to train their models, and Recital 107 explains that this transparency requirement is intended to support copyright holders in exercising their rights. Even so, uncertainty remains over how far the existing text and data mining exceptions extend to AI training, and EU member states continue to debate whether the current framework adequately addresses the scale and complexity of the practice.

Most member states nonetheless favour monitoring and clarifying the existing framework rather than introducing new legislation immediately, given the continued novelty of generative AI. This cautious approach is instructive for Oman, which may similarly benefit from clarifying and monitoring its existing copyright principles rather than enacting an entirely new framework at this stage.

The United States has not enacted a comprehensive federal AI statute; regulation instead derives from a mix of executive orders, existing sectoral laws applied to AI, and state legislation. In Thomson Reuters v Ross Intelligence (2025), the court rejected a fair use defence where Ross had engaged a third party, LegalEase, to produce training data that substantially copied headnotes from Thomson Reuters’ Westlaw platform. The court found that Ross had directly copied thousands of these headnotes and rejected fair use primarily because Ross intended to use the resulting AI tool to compete directly with Westlaw, a factor the court held weighed decisively against fair use.

By contrast, in Bartz v Anthropic (2025), Anthropic had trained its Claude models using a mix of purchased and pirated books to build a permanent digital library, arguing that the books were essential to training its models. The court found that Anthropic’s use of purchased books constituted fair use, but that its use of pirated copies did not.

The US approach is therefore highly fact-specific, with outcomes varying case by case, and indicates that fair use may apply, but only within certain limits. The EU, by contrast, takes a legislative approach through the text and data mining exception in Directive (EU) 2019/790.

Jurisdictions aside from the EU and the USA have taken different approaches. The United Kingdom, for example, has no broad copyright exception permitting commercial AI training on protected works, although proposals for a text and data mining exception remain under discussion.

These divergent approaches show that there is no settled international consensus on whether copyrighted content may be used to train AI systems. Oman therefore has no single international model to follow and should instead weigh the interests of copyright holders against the goal of supporting AI development in determining its own approach.

Recommendations

The existing exceptions under Article 20 are tied to non-commercial, educational, or family contexts. We recommend amending Article 20 to introduce a new AI training clause permitting commercial entities to use copyrighted content for AI training, provided they have lawful access to that content, whether through licensing, subscription, or other authorised means. This carve-out is necessary because AI development in Oman is largely a commercial activity; without it, a company would remain excluded from the exception even where it has lawful access to the content it seeks to use. At the same time, original creators may face heightened competitive risk, as AI-generated content trained on their work could saturate the market with similar output and reduce demand for their future work.

Oman may also wish to adopt a gradual approach to regulating AI training on copyrighted content, rather than introducing a comprehensive AI-IP framework immediately, given that the technology remains relatively new and not yet fully understood. Instead, Oman should clarify the existing copyright law to specify the circumstances under which AI training can use protected work without infringing copyright, potentially through a text and data mining exception modelled on the EU approach, paired with an effective opt-out mechanism allowing copyright holders to reserve their work from AI training. Oman should also impose transparency obligations requiring AI developers to disclose the sources and content used to develop their systems, strengthening copyright holders’ ability to identify and enforce their rights without imposing an outright prohibition on the use of their content for AI training. Given the rapid development of generative AI and the current uncertainty in copyright law, these recommendations would allow Oman to protect copyright holders’ interests while continuing to encourage technological innovation.

These reforms also carry risks. A broad text and data mining exception could weaken copyright protection by allowing developers to use large quantities of copyrighted material, reducing copyright holders’ control over their work and its economic value. An opt-out mechanism may be difficult to enforce where ownership is unclear or content originates outside the country. Strict transparency requirements could impose high compliance costs on AI providers, potentially discouraging international companies from operating in Oman. There is also a risk that legislating before international approaches have stabilised could produce requirements that quickly become outdated.

Conclusion

Despite the risks of reform, the absence of regulation carries the greater risk: legal uncertainty. Without clear governance over whether copyrighted content can be used to train AI, both copyright holders and system developers face uncertainty in determining whether their conduct is lawful, which in turn complicates innovation in Oman. A carefully defined text and data mining exception would not eliminate copyright protection; rather, it would establish predictable circumstances in which works may be used, while preserving authors’ right to opt out. The goal should not be to eliminate all risk, an unrealistic aim, but to regulate use and provide greater certainty while respecting copyright holders’ rights. This is particularly important if Oman seeks to attract AI investment and build a competitive digital economy.

Authors

Nouf Al-Hoqani
University of Manchester, United Kingdom

—

Rayan Al-Hasni
Sultan Qaboos University, Oman

—

Zahra Al-Balushi
Modern College of Business and Science, Oman

—

Zayd Al-Harrasi
Nottingham Trent University, United Kingdom

—

Who is Taxed: Residents vs Non-Residents

Not everyone in Oman will be taxed the same way, the law draws a line between residents and non-residents.To begin with, under article 1, to be classified as a tax resident, an individual would have to have resided in the Sultanate of Oman for a period exceeding 183 days, continuous or intermittent, during a tax year. Anyone who does not meet this threshold is classified as a non-tax resident. This distinction matters because it determines the scope of income each person is taxed on. Article 6 imposes annual tax on net income of a tax resident in or out of the country. Meaning, tax residents get taxed on income made worldwide, while non-tax residents only get taxed on income made in Oman, a common approach that ties tax liability to where economic activity actually occurs, rather than to the individual.

How the Tax is Calculated

Not a single rial of income is taxed until it passes through three separate filters. First, gross income is simply defined as everything a person receives during a tax year, such as salaries, rent, interest, and so on. Second, every taxpayer starts with a 42,000 Rial Omani exemption on their gross income, since only earnings above this amount count as net income. For example, someone earning 60,000 Rial Omani a year would have a net income of 18,000 Rial Omani, which is the starting point for the next stage of calculations. Finally, the 18,000 Rial Omani is further reduced by any exemptions, allowable costs, and losses to arrive at the taxable income, to which Article 8’s 5% rate is then applied. Assuming no further deductions take place, the 18,000 Rial Omani would be taxed at 5%, resulting in a final tax bill of 900 Rial Omani.

What’s Taxed, and What’s Exempt

The law recognises eleven distinct sources of income, though it also exempts a handful of them entirely. Chapter Three of the Personal Income Tax Law outlines all the sources included in gross income, among them salaries, self-employment, rent, royalties, interest, and returns from stocks, real estate, and pensions. Article 25 carves out a number of exemptions, most notably for the sale of a primary residence, education and healthcare expenses for the taxpayer and their immediate family, and zakat and donations, capped at 5% of gross income. Taken together, these exemptions tend to target life’s essentials rather than income broadly, including housing, health, education, and charitable giving. Several are also limited in scope, the secondary residence exemption, for instance, can only be claimed once in a person’s lifetime, underscoring that these are targeted reliefs rather than a blanket reduction in tax.

Conclusion

The Personal Income Tax Law may not take effect until 2028, but its architecture is already clear. Royal Decree 56/2025 sets the structure, but the executive regulation will supply the details that determine how it actually works in practice, from allowable costs to compliance procedures. With more than a year still to go before the 1 January 2028 effective date, individuals and employers have time to get ahead of it, starting with the fundamentals laid out here.

To find out more on the upcoming personal income tax law, you can read the law on the link provided below:

Written by:

Zayd Al Harrasi

Zayd is a legal intern at Decree. He is interested in corporate, commercial, and company law. He is about to start the final year of his Business Law Degree at Nottingham Trent University.

The new MCP server covers Decree’s Arabic collection alongside the English one. Answers are no longer limited to what we have translated into English, and material that exists only in Arabic is now within reach, including the full text of MJLA fatwas. You no longer need to think about the language of the source. Claude and other tools will search our database in both Arabic and English and answer you in the language you are working in.

The new server is also far better at knowing which version of a law matters. It tells Claude whether an instrument is still in force, has been repealed, or has a consolidated version that supersedes it, so the answer you get quotes the text that actually applies today.

Connecting Decree MCP to Claude

Open Claude, either the desktop app or claude.ai, and go to Settings, then Connectors. Choose “Add custom connector” and paste in https://mcp.decree.om/. Claude will ask you to sign in: use the email address on your Decree account, and we’ll send you a six-digit code to confirm it.

From then on, just ask your legal questions as you normally would. Claude will search Decree on its own when a question calls for it. Try “Is the Omani Labour Law still current, and what changed?” to see it work.

If you set up Decree MCP after our May announcement, you will have a connector pointing at mcp-lr.decree.om. Please delete it. Leaving both in place means your assistant sees two sets of Decree tools and may keep reaching for the older one, which searches only the English collection and does not track amendments using our new smarter logic. In Claude, go to Settings, then Connectors, find the old Decree entry, and remove it before or after adding the new one.

Access is available to Decree members whose subscription includes Lex AI.

More details on how to use Decree MCP are available here:

Decree Risk has until now been a forward-looking tool, reporting liquidations within hours of their announcement so that creditors can lodge their claims with the liquidator before the legal six-month window closes. It could not answer questions about liquidations that took place before Decree Risk was launched.

That matters most when cleaning up legacy receivables. An ageing debtor ledger almost always contains accounts belonging to companies that entered liquidation years ago, and there was no practical way to identify them other than working backwards through years of gazette issues by hand. With thirteen years of announcements now in the database, a finance or collections team can run an entire ledger against the full record in one pass, write off what is no longer recoverable, and act on any account that still falls within a claim period.

The historical records cover announcements published in the Official Gazette from February 2013 to the present, and are structured in the same way as the entries we publish daily.

They are searchable on Decree Risk alongside current announcements, and are also available through our liquidation section, which lets you download the liquidations published in each issue of the Official Gazette on an issue-by-issue basis. For organisations that work with the data in their own systems, the full record is also available through the Decree API, so an existing integration can now query thirteen years of announcements rather than recent ones alone.

Decree Risk is available through a bundle subscription to Decree. If your current bundle does not include Decree Risk, or if you are not yet a member of Decree, you can request a free trial by contacting us here.

A New Design

The app has been rebuilt for the latest version of iOS, with a cleaner and more modern look throughout. We’ve also refined dark mode and improved the Arabic experience across every screen, so the app reads well whichever language you work in.

Now on iPad

Decree is now a full iPad app. Rather than a stretched phone layout, you get a proper side-by-side view that keeps your conversations in sight while you read, which makes the iPad a practical place to do sustained research.

Working with Lex AI

• Faster Answers: Lex AI now returns answers noticeably faster on mobile.
• Suggested Questions: Every new conversation opens with prompts to get you started.
• Conversation Controls: Pin, rename, or delete a conversation without leaving the chat.
• Pick Up Where You Left Off: Conversations now open at your latest message.

Availability

The Decree app is available to all users with a subscription bundle that includes Lex AI. Update to version 3.0 on the App Store to get started.

If your current bundle does not include Lex AI, or if you are not yet a member of Decree, you can request a free trial by contacting us here.

Before turning to those routes, it’s helpful to understand the two types of contracts recognised by law. A definite (fixed-term) contract runs on an agreed period of time and simply comes to an end when either the period has expired or the agreed work is complete, the employer does not need to state a reason; the contract can be allowed to lapse by not renewing it. An indefinite contract, by contrast, has no set end date, so it can only be brought to an end by invoking one of the grounds the law provides.The employer can’t simply end it without falling under one of these grounds.

Dismissal without notice or gratuity

Article 40 gives employers a limited and serious set of grounds for dismissing a worker immediately, without notice or gratuity. This includes earning a job via a false identity or forged documents, causing serious material loss through a mistake (provided the ministry is informed within 30 working days), disregarding written safety instructions after a prior written warning, unauthorised absence exceeding seven consecutive or ten intermittent days in a year, disclosing the employer’s confidential information, a final conviction for a felony or a crime against honour or trust, being intoxicated or under the influence of narcotics during working hours, assaulting the employer, a superior, or a colleague at the worksite, and any serious breach of the worker’s contractual obligations.

Immediate termination initiated by worker without losing entitlements  

According to article 41, the worker can end the employment relationship without abiding by the usual notice period, or prior to the expiration of the fixed-term contract, while maintaining rights and end-of-service gratuity, if the employer induced the contract through fraud, failed to pay wages for more than two consecutive months or otherwise failed to meet its fundamental obligations, committed an act contrary to public morals towards the worker, assaulted the worker, or exposed the worker to a serious safety or health danger that the employer knew about and failed to address.

Employer termination with notice

Article 43 permits the employer to end an indefinite contract unilaterally, after notice, in certain situations like the worker reaching the age of retirement under the Social Protection Law; ending a non-Omani worker’s service to replace them with an Omani in the same role; failure to reach required competency after a written warning and a grace period of at least six months, in which case an Omani worker’s replacement must also be Omani; and closure or partial closure, bankruptcy, reduced activity, or a change in production methods that affects workforce size. For grounds of competency and restructuring, the employer should inform the ministry of the reason three months prior to the date of termination, and should avoid terminating an Omani worker whose competency and experience match those of a non-Omani colleague retained in the same establishment.  

Articles 44 to 46 set out a formal procedure where a genuine economic cause exists with a financial loss sustained for at least two consecutive years, not merely a failure to profit.  The employer applies to a dedicated committee chaired by the ministry, with the Ministry of Commerce, Industry, and Investment Promotion, the Oman Chamber of Commerce and Industry, and the General Federation for Workers of the Sultanate of Oman as members. The committee can approve the reduction, reject it, or impose alternatives such as shorter hours, unpaid leave, or reduced wages across the workforce. If a reduction is approved, the employer must select workers by a fair standard such as performance, give at least three months’ notice, and give those affected priority in re-employment if a suitable vacancy later arises.

Conclusion

This blog post highlighted some cases by which an employment contract can be terminated by the employer or the employee. The law also provides for other cases through which an employment relationship can come to an end, such as the death of the worker or his incapacity to work.

It is highly recommended for everyone to make themselves familiar with the Labour Law. You can read it in English on the link below:

Written by:

Malak Al Kharusi

Malak is a legal intern at Decree. She has previously interned in the government sector. She is interested in commercial law. She is about to start the final year of her Business Management and Law degree at Leeds Beckett University.