What Oman's Personal Data Protection Law Means for WhatsApp Promos

On a quiet Thursday evening, Basma, who owns a beauty salon in Al Khuwair, scrolls through three years of saved WhatsApp numbers and sends one broadcast: 20 percent off gel manicures this month. Oman's Personal Data Protection Law turns that single tap into five practical questions: why you have the number, whether you were allowed to message it, what you do when someone says stop, what you owe a customer who asks what you hold on them, and how long you can keep it. Get those five right and a WhatsApp promo stays what it should be, good marketing, not a compliance problem.

Oman's Personal Data Protection Law, in plain terms

Oman's Personal Data Protection Law is Royal Decree 6 of 2022. It entered into force in 2023, and its Executive Regulation followed in February 2024, spelling out how businesses must apply it day to day. The Ministry of Transport, Communications and Information Technology (MTCIT) oversees the law and can issue administrative fines of up to OMR 2,000 for a single violation.

Legal reviews that track Oman's compliance timeline note that the law's transition period closed and it became fully enforceable in February 2026. By September 2026, that means a small salon or a workshop is covered exactly like a large company, size does not exempt you. Personal data, in plain terms, is any information that identifies a real person. A name saved next to a phone number in your contacts counts. A separate guide to the Personal Data Protection Law covers registration, breach rules and cross-border transfers in more depth.

Purpose: why you have the number matters

Basma saved most of those numbers to confirm appointments, remind a customer about a booking, or send a receipt. That is one purpose. Turning around and using the same number to sell a manicure discount is a different purpose, and the law's general consent principle, in Article 10, says personal data cannot be processed without the data subject's explicit consent for what you are actually doing with it.

In practice this means you cannot quietly assume that because someone is saved in your phone, they agreed to be marketed to. If the number came from a booking form, check what that form actually said. If it only mentioned appointment reminders, marketing is a new ask, and it needs its own permission.

Permission: the message only goes to people who said yes

Article 22 of the law is specific: a business must obtain the customer's written consent before sending any advertising or marketing material. Written consent can be a tick box at checkout, a signed form, or a saved WhatsApp reply that says yes, send me offers, screenshotted and dated.

If a customer never agreed, sending the promo anyway is exactly the kind of processing Article 22 restricts, no matter how long the number has been sitting in your phone. The safer habit is to build the marketing list from opt-ins going forward, and treat everyone else as reminder-only contacts until they say otherwise.

Opt-out records: keep the proof, not just the memory

When a customer replies stop or no more messages, the law expects you to act immediately and free of charge, and to be able to show, if the Ministry ever asks, that you did. A memory of I think I removed her is not a record. A simple log with a few columns does the job.

• Customer name and number
• Date and method of consent, tick box, form, or WhatsApp reply
• Date of any opt-out request
• Who processed the opt-out and when
• Whether the number is still active in your marketing list

Basma's promo, worked out

Here is the same WhatsApp promo, redone the compliant way. These are example figures for one salon, run your own list through the same steps with your own numbers.

1. Basma counts her WhatsApp contacts saved from bookings: 480 numbers gathered over three years.
2. She checks her booking records for a tick box or written reply agreeing to marketing messages: 190 customers said yes.
3. She sends the 20 percent gel manicure promo only to those 190, not the full 480.
4. A normal gel manicure at her salon costs OMR 12; the promo drops it to about OMR 9.60.
5. If 15 percent of the 190 respond, that is about 28 bookings, worth roughly OMR 269 in sales that month.
6. Messaging the other 290 customers who never agreed would not add guaranteed sales, but it would add fine exposure of up to OMR 2,000 per violation if even one of them complains to the Ministry.

Access: what you owe a customer who asks

A customer can ask what personal data you hold on them. Article 11 gives them the right to obtain a copy of their processed personal data, and Article 14 requires you to have already told them about this right, usually in a short notice at the point you collected their number.

Legal reviews of the Executive Regulation describe a response window of 45 days, and the response must be free of charge. A written note from your customer list, or a simple export, is usually enough. Refusing a request without a documented reason is not.

Retention: how long can you keep the number

Article 17 requires the controller, meaning the business that decides why data is collected, to keep records of its data processing activities for the periods and procedures the Executive Regulation sets, rather than forever by default. The regulation leaves some detailed timing to sector rules, so one exact number that applies to every business type was not publicly available when this article was written.

The safe habit is simpler than the legal text: keep a number only as long as you have a real business reason to, a live client relationship, an unresolved invoice, a warranty period. If this list feels overdue for a cleanup, an earlier guide on how the customer list in your phone can become your biggest privacy risk walks through the same problem from a different angle.

Keeping consent records: how systems compare

Most small businesses end up needing somewhere to store this: who agreed to marketing, when, and who opted out, alongside the rest of the customer record. A spreadsheet works fine at 480 contacts; it gets harder past a few thousand. Here is how four systems used by small businesses in Oman compare on that specific job.

For an Omani service business that mainly needs one place to track bookings, invoices and consent status without hiring an IT team, Amaal fits that specific job best among these four. The honest limitation is timing: several of Amaal's modules are still rolling out through April 2027, so check what is live today before you plan around it.

What this means for you

• Before your next WhatsApp promo, check whether the number was given for reminders only, or for marketing too.
• Only message customers who gave written consent to marketing, a tick box, a signed form, or a saved reply.
• Keep a simple log of who opted in, when, and who opted out, so you have proof if you are ever asked.
• If a customer asks what you hold on them, respond within a reasonable time and without charging a fee.
• Review your customer list at least once a year and drop numbers you no longer have a business reason to keep.

The bottom line

A WhatsApp promo to old customers is not illegal under Oman's Personal Data Protection Law. But sending it without written consent, a record of opt-outs, and a plan for access requests turns a marketing win into legal exposure. Fix your list once using the five questions in this article, purpose, permission, opt-out records, access and retention, and every future broadcast becomes routine instead of risky.