The law, in plain language
What the Personal Data Protection Law is
The Personal Data Protection Law of Oman gives people control over their personal information and puts clear duties on every organisation that holds it. Here is the short version.
Issued by Royal Decree
Oman's Personal Data Protection Law was issued under Royal Decree No. 6/2022 and has been in force since 2023.
Overseen by MTCIT
The Ministry of Transport, Communications and Information Technology supervises the law and its executive regulations.
Protects people in Oman
It governs how any organisation collects, stores, and uses the personal data of individuals in Oman.
Real penalties
Mishandling personal data can bring fines and other sanctions, so compliance is a floor, not a nice-to-have.
What it asks for
Six duties the law puts on you
Amaal is designed so that meeting these is the default, not a project you have to run on the side.
Consent & a lawful basis
Collect personal data with the person's clear consent, or another lawful basis, and tell them why.
Purpose limitation
Use data only for the purpose it was collected for, and keep it no longer than needed.
The individual's rights
People can ask to see, correct, or delete their data, and withdraw consent at any time.
Extra care for sensitive data
Health, biometric, genetic, and similar data get stricter handling than ordinary records.
Limits on crossing borders
Moving personal data outside Oman is restricted, so keeping it in-country avoids the whole problem.
Breach response
If data is exposed, there are duties to act and notify, which is why prevention and audit trails matter.
Hosted in Oman
Your data never leaves the country.
Amaal stores your database and every uploaded file in cloud infrastructure located inside Oman. Nothing is copied to a server abroad, so the law’s restrictions on moving personal data across borders simply don’t apply to you. The data stays where your people, and the regulator, expect it to be.
In-country by design
Cloud hosting located in Oman. No cross-border transfer of your personal data.
Security & anti-hacking
How Amaal keeps personal data safe
Security isn’t a feature you switch on. It is how the platform is built. Here is exactly what protects your data.
Data never leaves Oman
Your database and files live in cloud infrastructure located in Oman. Nothing crosses a border to sit on a server abroad.
Encrypted in transit & at rest
Every connection is protected with TLS, and your data (records and uploaded documents) is encrypted while stored on disk.
Passwords are hashed, never stored
Passwords are put through a one-way hash. Amaal never keeps them in plain text and cannot read or recover them, not even our team.
Role-based access
People see only what their role allows. A field officer cannot open payroll; a viewer cannot edit. Access is least-privilege by default.
Full audit trails
Who viewed, changed, exported, or deleted what, and when, is recorded across every module, so nothing happens without a trace.
Hardening & backups
Network protections, monitoring, regular encrypted backups, and routine patching guard against intrusion and loss.
Encrypted (we can show it to you again)
- Personal records (names, contacts, salaries, HR files)
- Uploaded documents (contracts, IDs, certificates)
- Everything in transit, over TLS
- Data at rest, on disk
Hashed (nobody can read it back)
- Account passwords (one-way, irreversible)
- Security tokens and secrets
Encryption is reversible with the right key, so we can show your records back to you. Hashing is one-way, so passwords are never stored or recoverable in plain text, not even by Amaal.
Export anytime
Full database + every file, downloaded from the admin portal by your own administrator.
Your data is yours
We can never hold your data hostage.
This is the worry we hear most: “what if there’s a dispute, or we stop paying, is our data trapped?” With Amaal, no. The admin portal lets an authorised administrator download a complete copy of your database together with all your files, at any time. Your data is never used as leverage, not in a dispute, not over payment, not ever.
Because everything is hosted in Oman and exportable on demand, you stay in full control of your own records, exactly as the Personal Data Protection Law intends.
Who is responsible for compliance? We are.
Keeping the platform compliant with Oman’s Personal Data Protection Law is Amaal’s responsibility: hosting your data in Oman, securing it, and giving you the controls the law expects. Your business stays the owner of its data and decides what to collect; Amaal is the partner that keeps it lawful, secure, and in-country underneath you.
This page is a plain-language overview to help you understand the Personal Data Protection Law of Oman; it is not legal advice. For formal guidance, refer to the MTCIT and your own legal counsel.
Data protection FAQ
Security & compliance: questions people ask
The questions we get asked most when businesses evaluate Amaal, answered plainly.
Is Amaal compliant with Oman's Personal Data Protection Law?
Yes. Amaal is built to comply with Oman's Personal Data Protection Law (issued under Royal Decree 6/2022 and in force since 2023). Amaal hosts your data inside Oman, encrypts it in transit and at rest, hashes passwords, controls access by role, and logs every action. Amaal takes responsibility for keeping the platform itself compliant.
Who is responsible for Personal Data Protection Law compliance, us or Amaal?
Amaal takes responsibility for the compliance of the platform: hosting your data in Oman, securing it, and giving you the controls the law expects. In legal terms your business remains the data controller for the information you choose to collect, and Amaal acts as the processor that keeps that data lawful, secure, and in-country on your behalf.
Where is our data stored?
All of your Amaal data, the database and every uploaded file, is stored in cloud infrastructure located inside Oman. Nothing is moved to a server in another country, which keeps you clear of the law's restrictions on cross-border transfers.
How does Amaal protect against hacking?
Amaal protects your data with encryption in transit and at rest, one-way hashed passwords, strict role-based access, complete audit trails, network hardening and monitoring, and regular encrypted backups. Together these guard against intrusion, tampering, and data loss.
What data is encrypted, and what is hashed?
In Amaal, personal records and uploaded documents are encrypted, both while moving over the network (TLS) and while stored on disk. Passwords and security secrets are hashed instead: run through a one-way function so they can never be read back, even by Amaal's own team. Encryption protects data we need to show you again; hashing protects secrets we never need to see.
How are our documents protected?
Documents in Amaal are stored encrypted, opened only by people whose role permits it, and every view, download, and change is written to an audit trail. Expiry alerts and version history mean sensitive files are controlled, not just dumped in a folder.
Can Amaal hold our data hostage in a dispute or if we stop paying?
No. The Amaal admin portal lets an authorised administrator download a complete copy of your database together with all of your files at any time. Your data is yours. It is never held as leverage in a dispute, over non-payment, or for any other reason.
