Skip to content
World Watch

Cybersecurity law & regulation in Oman (2026)

Cybersecurity in Oman: comprehensive law.

Oman operates a multi-layer cybersecurity regime anchored by the Cybersecurity Law (RD 52/2017) and the Cyber Defence Centre established under RD 64/2020, which together impose cross-sector security obligations and mandatory incident reporting on public and private entities. The Personal Data Protection Law (RD 6/2022), which entered full enforcement on 5 February 2026, adds a 72-hour breach notification duty, while the Cybercrime Law (RD 12/2011) criminalises digital offences. MTCIT issues binding governance guidelines and sector-specific standards supplement these foundational laws.

Last verified Official sources first · MethodologyCompare Oman with other countries

Legal framework

Royal Decree No. 52/2017 (Cybersecurity Law) and Royal Decree No. 64/2020 (Cyber Defence Centre), administered by the Ministry of Transport, Communications and Information Technology (MTCIT) and the Cyber Defence Centre (CDC) under the Internal Security Service

Key points: cybersecurity in Oman

  1. Cybersecurity Law (RD 52/2017)

    Royal Decree No. 52/2017 establishes primary cybersecurity obligations applicable across government and private-sector information systems, requiring protection of critical digital infrastructure and compliance with national cybersecurity standards set by MTCIT.

    dataguidance.com doverunner.com

  2. Cyber Defence Centre (RD 64/2020)

    Royal Decree No. 64/2020 established the CDC as the central national cybersecurity oversight authority, reporting to the Internal Security Service. All stakeholders are legally obliged to immediately notify the CDC of any real or potential cybersecurity threat or breach, extending to operators of critical infrastructure, essential services, digital service providers, and government institutions.

    decree.om mjla.gov.om dataguidance.com

  3. Personal Data Protection Law (RD 6/2022)

    The PDPL entered full legal force on 5 February 2026 after a four-year adaptation period. It mandates data breach notification to the National Cyber Governance and Assurance Affairs (NCGAA) and affected individuals within 72 hours. Ministerial Decision No. 34/2024 further requires DPO appointment and external auditors for processors handling sensitive data.

    searchinform.com dataguidance.com

  4. Cybercrime Law (RD 12/2011)

    Royal Decree No. 12/2011 criminalises unauthorised access to IT systems, data destruction, network disruption, cyberterrorism, electronic fraud, and credit card misuse. It applies to public and private actors and constitutes the primary enforcement instrument against cyber offenders.

    moheri.gov.om decree.om

  5. MTCIT Governance Guidelines and NCIS

    MTCIT issues mandatory Cybersecurity Governance Guidelines for public entities and operates the National Center for Information Security (NCIS). In the first nine months of 2024, NCIS handled 136 cybersecurity incidents and issued 25 security alerts. OCERT provides incident-response coordination and public awareness.

    mtcit.gov.om oman.om

  6. Sector-specific critical infrastructure rules

    The Authority for Public Services Regulation has issued dedicated Cyber Security Standards for electricity and water providers, including ICS/SCADA protections. Oman's national cybersecurity strategy, aligned with Vision 2040, targets top-10 global cybersecurity readiness and guides enhanced protections for critical infrastructure operators across all regulated sectors.

    apsr.om ncsi.ega.ee

Sources

  1. decree.om/2020/rd20200064/
  2. mjla.gov.om/eng/legislation/decrees/details.aspx?Id=1207&type=L
  3. moheri.gov.om/userupload/Policy/The%20Cyber%20Crime%20Law.pdf
  4. decree.om/2011/rd20110012/
  5. mtcit.gov.om/library-3/guidelines-documentation-7/guidelines-68/cybersecurity-gove
  6. dataguidance.com/jurisdiction/oman
  7. apsr.om/pdfs/CyberSecurityStandards/cyber-security-standards.pdf
  8. searchinform.com/blog/2026/2/18/oman-pdpl-2026-full-enforcement-dlp-compliance/
  9. ncsi.ega.ee/country/om/
  10. oman.om/en/home-top-level/whole-of-government/central-initiative/oman-nationa
  11. doverunner.com/blogs/oman-cybersecurity-regulations-compliance-guide/
  12. dataguidance.com/news/oman-mola-publishes-royal-decree-642020-establishing-cyber-defen

Next for Oman: Starting a BusinessModerate

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026