Oman's data protection law and AI chatbots: a practical checklist
If your chatbot handles customer messages in Oman, it processes personal data. This checklist translates the law into engineering decisions. It is not legal advice: confirm specifics with a qualified lawyer.
By Faisal Al Anqoudi · Muscat, Oman · Updated
Where the law stands
- Oman's Personal Data Protection Law was issued by Sultani Decree 6/2022, with executive regulations issued in 2024.
- The transition period ended on 5 February 2026, so the law is now fully enforceable.
- Royal Decree 68/2026, effective 7 September 2026, amended the law: it widens its territorial scope, adds cases where data may be processed without explicit consent, and sets a framework for automated processing and automated decision-making.
- The Ministry of Transport, Communications and Information Technology is the regulator.
Checklist for a chatbot
- Transparency: tell users they are talking to an AI and why their data is used.
- Lawful basis: record whether you rely on consent or another permitted ground.
- Minimisation: collect only the data the task needs; do not ask for ID numbers in chat unless necessary.
- Retention: set how long chats are kept and delete automatically after that.
- Access: restrict who on your team can read conversations and log that access.
- Vendors: know where your language-model and hosting providers process data, and sign data-processing terms.
- Transfers: check rules for sending personal data outside Oman before choosing a provider region.
- Automated decisions: keep a human in the loop for decisions that significantly affect a person.
- User rights: make it possible to find, correct, export and delete a person's data on request.
- Security: encrypt data, protect keys, and test for prompt injection and data leakage.
Penalties
Law-firm summaries report fines of up to OMR 500,000 for the most serious breaches, such as unlawful data transfers. Check the current text of the law for exact penalties.
Frequently asked questions
- Does the PDPL apply to a small business chatbot?
- If it processes personal data of people in Oman, it generally falls under the law regardless of company size. Confirm your situation with a lawyer.
Sources
Let's talk about your project
Book a short call and tell me what you want to build.