Sultan Haitham bin Tariq of Oman issued Royal Decree 68/2026 on September 3, 2026, amending provisions of the Personal Data Protection Law (PDPL) promulgated by Royal Decree 6/2022. The decree promulgates attached amendments to a law in force since February 13, 2024, and enters into force the day after its publication in the Official Gazette. The amending text itself is not yet public: the decree notes the attachments will be available once the Gazette publishes them.
This closes a legislative track the market has tracked for months. A Council of Ministers draft amending 13 articles of the PDPL reached consensus in the joint State Council and Majlis A'Shura committee in April 2026 and was reviewed in the May 13, 2026 joint session. Based on that track, the changes are expected to clarify the law's territorial scope for processing relating to individuals in Oman, define automated processing, and tighten purpose-limited retention. The decree text fixes entry into force as the day after Gazette publication, so controllers should treat that publication as the trigger for final wording.
What does Royal Decree 68/2026 change?
Royal Decree 68/2026 amends the PDPL (RD 6/2022), Oman's cornerstone data-protection statute, under which compliance has been live since February 13, 2024. Article 1 applies the attached amendments to the law; Article 2 repeals any conflicting provisions; Article 3 publishes the decree in the Official Gazette and brings it into force the day after publication. An English version is available on the official decrees portal.
The exact amended articles will be visible only on Gazette publication, but the legislative record indicates the substance. The Council of Ministers draft that advanced through the Council of Oman targeted 13 articles and centred on three areas: clarifying the territorial scope so processing relating to individuals in Oman is clearly covered, defining automated processing, and tightening purpose-limited data retention. Until the Gazette text publishes, controllers should work from these tracked themes and confirm exact thresholds and wording the day the text drops.
Who must act on the amendments?
Every controller and processor handling personal data of Oman residents is in scope, including foreign companies with Omani operations or that process Omani-resident data from abroad. The PDPL applies to processing relating to individuals in Oman, and the amendment's expected territorial-scope clarification widens the perimeter compliance teams must map.
The most exposed actors are Omani banks (BankMuscat, NBO, NBD), telecommunications operators (Omantel, Ooredoo Oman), healthcare providers, retailers and e-commerce platforms. Cross-border processors, cloud providers and group-level data-sharing arrangements also fall within the retention and transfer recalibration the amendments demand. The Data Protection Committee, under the Ministry of Transport, Communications and Information Technology (MTCIT), supervises compliance.
When does the amendment take effect, and what is the timeline?
The decree enters into force the day after its Official Gazette publication. The decree's own note states the amending attachments will be available once the Gazette publishes them, expected imminently. Compliance teams should not wait for the Gazette to begin readiness work, because the entry-into-force date is the day after publication, leaving no transition window once the text is public.
The PDPL itself has been enforceable since February 13, 2024, after a two-year grace period from its February 13, 2022 issuance. This amendment lands on a live compliance baseline, not an anticipatory one: controllers already operating PDPL programmes must adjust them, not build from scratch.
| Milestone | Date | Significance |
|---|---|---|
| PDPL issued (RD 6/2022) | February 13, 2022 | Baseline law |
| PDPL enters into force | February 13, 2024 | Compliance live |
| Council of Oman consensus | April 2026 | 13-article draft agreed |
| Joint session review | May 13, 2026 | Draft reviewed |
| Royal Decree 68/2026 issued | September 3, 2026 | Amendment promulgated |
| Entry into force | Day after Gazette publication | No transition window |
What should compliance teams do before the Gazette publishes?
Teams should now confirm whether their processing falls within the amended territorial scope, pre-map consent, retention and cross-border transfer programmes against the three tracked themes, and assign ownership for the day-after-Gazette review of the exact amended articles. Cross-border transfer routes warrant particular attention, because a tightened retention rule and a clarified territorial scope together change what data may leave Oman and for how long.
Brief the Data Protection Committee contact and the relevant business owners on the imminent entry into force, and stand up a watch on the Official Gazette so the final wording is captured the day it publishes. The PDPL is already live, so this is a recalibration, not a greenfield build.
Obsidian's per-jurisdiction monitoring surfaces decrees like this as they break, ahead of the Gazette text that finalises the wording.
Subscribe to the free newsletter
Verify your applicability against the amended territorial scope, check the day-after-Gazette entry-into-force date, and brief your data-protection team now: the window to prepare closes the moment the Official Gazette publishes the amended text.
