Oman's TRA Drafts New Cybersecurity Rules for Connected Cars

Your next car might phone home, and Oman's telecom regulator wants to make sure "home" means a server inside the Sultanate. On 11 August 2026, the Telecommunications Regulatory Authority (TRA) opened a public consultation on draft technical regulations for internet-connected vehicles, covering data protection, cybersecurity, and where vehicle data can legally live.

🔑 Key Takeaways

• The TRA's draft framework, published for public feedback on 11 August 2026, covers five areas: telecommunications SIM cards used in vehicles, emergency communications and roadside assistance, data governance, technical infrastructure, and disclosure and reporting requirements, according to Muscat Daily.
• Vehicle-generated data would need to be localised within Oman, and the proposal asks whether emergency calls and roadside-assistance requests from connected cars should be routed directly to call centres located in Oman, as Oman Tech News reported.
• The public consultation window runs for three weeks and closes on 1 September 2026, with automotive manufacturers, telecom operators, technology providers, and members of the public invited to respond.
• The TRA says the goal is to strengthen data and privacy protection and improve cybersecurity as connected technologies become standard equipment in modern vehicles, per Muscat Daily's reporting.
• The move extends a data-localisation pattern already visible in Oman's cloud computing rules and its Personal Data Protection Law (PDPL), now applying it to a fast-growing category: cars.

🚗 What the TRA Is Actually Proposing

Modern cars are no longer just engines and wheels. Telematics units, infotainment systems, and embedded SIM cards now stream location data, driving behaviour, diagnostics, and even biometric information back to manufacturers and third-party service providers. The TRA's draft regulation is designed to catch up with that reality before it becomes a governance gap.

According to Muscat Daily, the consultation questionnaire asks stakeholders directly whether current data classification and security-control proposals are strong enough to protect vehicle owners, and whether requiring emergency and roadside-assistance communications to route through Oman-based call centres is the right approach, while inviting alternative suggestions from respondents who disagree.

Oman Tech News reports that the framework also targets automated eCall-style emergency notification protocols, aiming to guarantee that accident alerts are routed rapidly to Omani emergency response teams rather than a manufacturer's regional or global data centre.

The TRA has not named individual automakers or telecom partners in the draft, and no TRA official has issued a public statement beyond the consultation document itself. All submitted feedback will be reviewed, though the authority is not obliged to adopt every recommendation it receives during the three-week window.

🔒 Part of a Bigger Data-Localisation Pattern

This is not the TRA's first move to keep sensitive data inside the Sultanate's borders. In September 2024, the regulator issued Decision No. 1152/2/19/2024-20, which classified data into four sensitivity tiers and barred cloud service providers from transferring Level 3 and Level 4 data (covering regulated private-sector and government or financial information) outside Oman without prior TRA approval, as detailed by a legal analysis on Mondaq. That framework fed directly into local operators' push to build sovereign hosting capacity, including Omantel's Otech sovereign cloud platform, which became the first Middle East operator accredited by AWS to deliver sovereign cloud services.

The connected-vehicle draft also arrives roughly six months after Oman's Personal Data Protection Law moved from a transition period into full, active enforcement. As of 5 February 2026, the PDPL requires organisations to notify the regulator, and in serious cases the affected individuals, within 72 hours of any data breach that could pose a risk to data subjects' rights, according to a legal update from CMS. A car that streams location and driving data to a manufacturer's servers abroad would fall squarely inside that compliance perimeter, which helps explain why the TRA is moving to set sector-specific rules now rather than after connected and electric vehicles become mainstream on Omani roads.

📋 Who Needs to Pay Attention

• Automakers and dealers selling connected or partially autonomous vehicles in Oman will need to review how telematics data is collected, stored, and transmitted.
• Telecom operators supplying embedded SIM connectivity for vehicle fleets and infotainment systems are directly named as stakeholders in the consultation.
• Roadside assistance and insurance providers that currently route emergency calls through regional or international call centres may need to shift operations onshore if the localisation requirement is finalised.
• Fleet operators and logistics companies, an increasingly important segment given Oman's Vision 2040 push on smart mobility and logistics hubs like Duqm and Sohar, will also fall under any final rules.

🇴🇲 Why This Matters for Oman

Oman's cybersecurity sector has been growing steadily, with the market forecast to expand from roughly $135 million in 2025 toward the $214 million mark by 2031 as the Sultanate builds out its cyber industry, a trajectory this site covered when 30 cyber chiefs graduated earlier this year. The TRA's connected-vehicle proposal shows that growth isn't confined to banks, government networks, and data centres. It is now reaching into everyday consumer technology.

For ordinary residents, the practical upside is a clearer legal basis for demanding that a car's location history, driving data, and emergency-call records are protected under Omani law rather than a foreign jurisdiction's terms of service. For businesses in the automotive, insurance, and fleet management space, it means compliance planning should start now, not after the rules are finalised. The consultation stays open until 1 September 2026, giving manufacturers, telecom providers, and the public a limited window to shape the final framework before it becomes binding.