Royal Decree 68/2026: Oman Amends Its Data Protection Law

On the night of 3 September 2026, His Majesty Sultan Haitham bin Tarik signed ten Royal Decrees covering everything from narcotics law to a $2.5 billion rail link with the UAE. Tucked into that batch was Royal Decree 68/2026, which formally amends Oman's Personal Data Protection Law (PDPL), the legal backbone for every digital government service, e-invoicing system and sovereign AI platform now running in the Sultanate.

🔑 Key Takeaways

• Royal Decree 68/2026, signed 3 September 2026, amends Royal Decree 6/2022, Oman's Personal Data Protection Law, according to the official text published on Oman's Decree.om legislative portal and confirmed by Oman Observer.
• The change caps roughly a year of legislative work: the Council of Ministers referred a draft amendment covering 13 articles to Majlis Oman, and a joint State Council-Shura Council committee only reached consensus on six disputed articles by April 2026, as Oman Observer reported at the time.
• The decree's substantive text was not yet public as of this writing; it takes effect the day after publication in the Official Gazette, per the decree's own procedural articles.
• Legal analysts at Trowers & Hamlins had flagged, based on the Shura Council's May 2026 review, that likely changes include tying the law's scope to a data subject's Omani residency and clarifying rules on automated processing and data retention, according to the firm's June 2026 analysis.
• The amendment lands seven months after the PDPL's compliance grace period ended on 5 February 2026, when Oman's regulator gained full enforcement powers, including fines of up to OMR 2,000 per violation, as detailed by CMS Law.

📜 What Actually Happened

Royal Decree 68/2026 is short and procedural by design. According to the decree's text on Decree.om, it contains three articles: the first implements a set of attached amendments to the Personal Data Protection Law, the second repeals any existing provision that conflicts with them, and the third orders publication in the Official Gazette, with the law taking effect the day after that publication. As of the decree's issuance, the site noted the attachments containing the actual amended articles were not yet available and were expected with the next Official Gazette issue.

That means Oman has confirmed a law change is happening, and has fixed the mechanism and effective date, before the public has seen the specific wording. It is an unusual sequence for outside observers to track, but it is consistent with how Oman typically handles legislative packages: the decree activates the change, and the Official Gazette carries the operative detail.

🧭 The Backstory: 13 Articles, Two Councils, One Year

This amendment did not appear overnight. As early as April 2026, Oman Observer reported that a joint committee of the State Council and the Shura Council had concluded discussions on a "Draft Amendment to Some Provisions of the Personal Data Protection Law" referred by the Council of Ministers. The draft touched 13 articles in total, six of which were points of disagreement between the two chambers of Majlis Oman. The committee reached consensus on all six and sent its report back for a joint session, the standard next step before a law returns to the Palace for the Sultan's signature.

By May 2026, according to Trowers & Hamlins' regulatory update, the Shura Council's review pointed toward two specific directions for reform: narrowing or clarifying who the law actually protects by tying its applicability to a data subject's Omani residency status, and adding clearer rules for automated data processing and data retention periods, both notorious grey areas in the law's original 2022 text.

🔍 Why Reform Was Overdue

Independent legal commentary published just days before the decree gives a sense of what practitioners had been pushing for. A detailed critique on Oman's Decree.om legal blog, published 30 August 2026, argued the PDPL had three structural gaps: a right of access that gives people a copy of their data but no context on why it was processed, who received it, or how long it will be kept; a consent-only framework that leaves data subjects with no general right to object once they've agreed to broad, bundled consent; and no route to individual compensation, since complaints can only go to the regulator rather than a court, unlike frameworks in the UK or Saudi Arabia.

Whether Royal Decree 68/2026 addresses all three gaps is not yet confirmed, since the attached articles are still pending Gazette publication. But the timing, a substantive reform critique landing four days before the amending decree, underscores that Oman's data protection regime was widely seen as due for a tune-up rather than a rewrite.

🏛️ Fitting Into Oman's Wider Data Push

The PDPL amendment does not exist in isolation. It sits alongside Oman's broader push to digitize public services, from the national addressing rollout to the gov.om portal, all of which depend on personal data moving safely between government entities and citizens. The Sultanate's newly published cyber strategy already lists data governance as one of its core pillars, and a tighter, clearer PDPL is a natural companion piece to that strategy rather than a standalone legal exercise.

It also matters for the identity and services infrastructure Oman has been building for years. As omanvision2040.com reported, Oman has digitized more than 2,277 government services touching everything from national ID renewal to hospital appointments, all of which run on personal data collected, stored and shared under the very law now being amended.

⏳ What Happens Next

Two things to watch. First, the Official Gazette publication itself, which will carry the actual amended articles and finally reveal whether the residency-based scope and processing-and-retention clarifications flagged back in May made the final cut, or whether the Majlis added provisions addressing the access-rights and compensation gaps raised in August. Second, the compliance clock: since the law takes effect the day after Gazette publication, organizations that handle personal data of Omani residents, banks, telecom operators, e-commerce platforms, hospitals, and every Sanad centre and gov.om integration in between, will have very little runway to review the changes once they land.

🇴🇲 Why This Matters for Oman

Oman has spent the past two years pushing sovereign AI platforms, unified government portals and nationwide e-invoicing, initiatives that all depend on trust in how personal data is handled. A clearer, better-enforced PDPL is what lets that digital infrastructure scale without becoming a liability. For businesses and government entities alike, the message from Royal Decree 68/2026 is straightforward: Oman's data protection law is not static, and the Official Gazette in the coming days deserves a closer read than most routine legal updates get.