Oman Recording Laws: All-Party Consent Rules and Penalties (2026)

How Oman Regulates Recording: Three Overlapping Laws

Oman does not rely on a single statute to govern recording and wiretapping. Instead, three major laws work together to create one of the stricter consent frameworks in the Middle East.

The Cybercrime Law of 2011 targets digital and electronic recording. The Penal Law of 2018 addresses traditional eavesdropping and privacy invasion. And the Personal Data Protection Law of 2022, which entered full enforcement in February 2026, adds a comprehensive data-processing layer that covers any personal information captured through recording.

For anyone living in, visiting, or conducting business in Oman, the practical result is straightforward: you need permission from every person involved before you press record. That rule applies whether you are on the phone, sitting across a conference table, or walking through a public market.

The Cybercrime Law: Royal Decree 12/2011

What Article 16 Prohibits

Article 16 of the Cybercrime Law is the provision most directly relevant to recording. It criminalizes using information technology tools to violate the privacy of an individual's personal or family life.

The prohibited acts include:

• Photographing any person using electronic devices without their consent
• Recording audio of any person using electronic devices without their consent
• Publishing or distributing recordings, photographs, or news related to someone's private life, even if the content is factually accurate
• Insulting or defaming individuals through recorded or published material

The scope of Article 16 is notably broad. It does not distinguish between recordings made in private and those made in public. It does not matter whether the content is true. The act of capturing someone's image or voice through technology without permission is itself the offense.

Penalties Under Article 16

A conviction under Article 16 carries:

• Imprisonment for not less than one year and not more than three years
• A fine of not less than OMR 1,000 and not more than OMR 5,000 (approximately USD $2,600 to $13,000)
• Or one of these two penalties

The minimum one-year prison sentence makes this a serious offense under Omani law. Courts have discretion to impose either the prison term, the fine, or both, depending on the circumstances.

How the Cybercrime Law Applies to Modern Devices

Article 16 uses the phrase "information technology tools," which Omani courts have interpreted broadly. The provision covers:

• Smartphones and their built-in cameras and microphones
• Laptops and tablets with recording capabilities
• Smartwatches and wearable devices
• Dedicated audio recorders and cameras
• Software applications that capture audio, video, or screenshots
• CCTV and surveillance systems operated without proper authorization

The law was written to be technology-neutral. As new recording devices enter the market, they fall under Article 16 without the need for legislative amendment.

The Penal Law: Royal Decree 7/2018

Privacy Protections in the Penal Code

Oman's Penal Law, enacted through Royal Decree 7/2018 and effective since January 15, 2018, contains provisions that criminalize privacy invasion through eavesdropping and unauthorized recording. These provisions operate independently of the Cybercrime Law, meaning a single act of unauthorized recording can theoretically violate both statutes.

The Penal Law criminalizes:

• Intentional eavesdropping on telephone calls or private conversations
• Recording or transmitting private conversations using any electronic device
• Taking or sharing photographs of a person or group of people without permission

Penalties under the Penal Law for these offenses can reach up to three years in prison.

How the Penal Law Differs from the Cybercrime Law

The two statutes overlap but are not identical. The Cybercrime Law specifically targets conduct carried out through information technology. The Penal Law covers a broader range of conduct, including non-digital eavesdropping and surveillance.

In practice, prosecutors have discretion to charge under either or both laws depending on the facts. A person who uses a smartphone to secretly record a private conversation could face charges under both Article 16 of the Cybercrime Law and the relevant privacy provisions of the Penal Law.

The 2025 Amendment

Royal Decree 11/2025 amended certain provisions of the Penal Law, primarily related to sentencing procedures and the suspension of penalties. While this amendment did not directly alter the privacy or recording provisions, it adjusted how courts may implement suspended sentences for various offenses, which could affect sentencing outcomes in recording-related cases.

The Personal Data Protection Law: Royal Decree 6/2022

A New Layer of Protection

Oman's Personal Data Protection Law (PDPL), issued under Royal Decree 6/2022, represents the most significant addition to the country's privacy framework in recent years. The law was published in February 2022, and after multiple extensions of the compliance transition period, it became fully enforceable on February 5, 2026.

The PDPL does not replace the Cybercrime Law or the Penal Law. Instead, it adds a data-protection framework on top of the existing criminal provisions. For recording, this means that capturing someone's voice or image now triggers obligations under data protection law in addition to the criminal penalties that already existed.

Consent Requirements Under the PDPL

The PDPL establishes explicit consent as the primary legal basis for processing personal data. Under the law:

• Processing personal data is not permitted except within the framework of transparency, honesty, and respect for human dignity
• The data subject must provide explicit consent before any processing occurs
• The request for consent must be written in a clear, explicit, and understandable manner
• Consent must be given voluntarily and without coercion
• The data subject has the right to revoke consent at any time

Audio recordings, photographs, and video footage all constitute personal data under the PDPL when they identify or can be used to identify an individual. This means that recording a conversation is a form of data processing that requires prior consent.

Executive Regulations (Ministerial Decision 34/2024)

The Executive Regulations to the PDPL, issued through Ministerial Decision 34/2024, provide additional detail on what constitutes valid consent. Under Article 4 of the regulations, consent must be:

• Issued by a person with full legal capacity
• Given in a clear manner and without coercion
• Documented in writing, electronically, or by any other means specified by the data controller

These requirements raise the bar for businesses that record phone calls or meetings. A vague disclaimer or a buried clause in terms of service is unlikely to satisfy the PDPL's standard for "clear, explicit, and understandable" consent.

PDPL Penalties

The PDPL introduces a tiered penalty structure that varies by the type of violation:

Violation Category	Minimum Fine	Maximum Fine
Failure to inform data subjects before collection	OMR 500	OMR 2,000
Processing violations (Articles 15-18, 20, 22)	OMR 1,000	OMR 5,000
Sensitive data or breach response failures	OMR 15,000	OMR 20,000
Cross-border transfer causing damage	OMR 100,000	OMR 500,000
Corporate liability (committed by leadership)	OMR 5,000	OMR 100,000

The maximum OMR 500,000 fine (approximately USD $1.3 million) for unauthorized cross-border data transfers is by far the heaviest financial penalty in Oman's privacy framework.

Additional administrative penalties include warnings, suspension of operating permits, administrative fines up to OMR 2,000, and cancellation of permits.

The Constitutional Foundation: Article 30 of the Basic Law

Oman's Basic Law, set out in Royal Decree 6/2021 (which updated the original Royal Decree 101/96), serves as the country's constitution. Article 30, located in the chapter on Public Rights and Duties, guarantees the privacy of all communications.

Article 30 states that freedom of correspondence by post, telegraph, telephone, or other means of communication is guaranteed. It is unlawful to monitor, search, disclose the confidentiality of, delay, or confiscate such communications except in cases specified by law and in accordance with procedures prescribed by law.

This constitutional provision forms the foundation upon which every recording-related statute in Oman is built. When courts interpret the Cybercrime Law, the Penal Law, or the PDPL, they do so in light of Article 30's broad guarantee of communications privacy.

The Criminal Procedures Law: When Authorities Can Record

While private recording requires consent, Omani law provides a narrow exception for law enforcement.

Article 90 of the Criminal Procedures Law (Royal Decree 97/99) establishes that conversations in private places may not be recorded, telephones may not be tapped, and dialogue may not be recorded without the permission of the Public Prosecutor.

The Public Prosecutor may grant permission only when:

• The recording would produce useful evidence
• There is a suspected offense or misdemeanor punishable by imprisonment exceeding three months
• The permission is issued in writing with stated reasons
• The authorization does not exceed 30 days (subject to renewal for similar periods)

This provision confirms that even the government cannot freely wiretap or record. Law enforcement must go through the Public Prosecutor and demonstrate a legitimate investigative need.

The Telecommunications Act: Royal Decree 30/2002

Article 55 of the Telecommunications Act provides an additional layer of protection specific to electronic communications infrastructure. Under this provision, any person who intercepts telecommunications without the written approval of the Telecommunications Regulatory Authority and outside what is permitted by law faces:

• Imprisonment for up to one year
• A fine of up to OMR 5,000

This provision targets technical interception of communications networks rather than the act of pressing record on a phone. It is primarily relevant to telecommunications companies, technology providers, and anyone who might attempt to intercept data traveling across Oman's communications infrastructure.

Phone Calls vs. In-Person Conversations

Phone Call Recording

Recording phone calls in Oman without the consent of all parties is illegal under both the Cybercrime Law and the Penal Law. The prohibition applies to:

• Personal phone calls between private individuals
• Business and commercial calls
• VoIP and internet-based calls (WhatsApp, Zoom, Microsoft Teams, and similar platforms)
• Calls recorded by automated systems, call center software, or CRM platforms

There is no exception for recording your own calls. Even if you are a direct participant in the conversation, secretly recording it violates Omani law.

Under the 1999 Criminal Procedures Code, recorded calls can only be used as personal references. They cannot serve as evidence in court proceedings unless all parties consented to the recording or the recording was authorized by the Public Prosecutor.

In-Person Conversations

The same all-party consent requirement applies to face-to-face conversations. Secretly recording a meeting, a negotiation, a personal discussion, or any exchange that takes place in a private setting is a criminal offense.

The law does not require the conversation to take place in a traditionally "private" location like a home or office. A conversation between two people at a restaurant, in a car, or at a shopping center can qualify as private if the participants have a reasonable expectation that the exchange is not being monitored.

Public Spaces: Restrictions and Risks

General Public Recording

Oman's recording laws extend into public spaces. Article 16 of the Cybercrime Law does not contain an exemption for recordings made in public areas. Photographing or recording a specific individual in a public space without their consent can trigger criminal liability.

Practical enforcement is more nuanced. General photography of landscapes, architecture, and large crowds where no individual is the focal point is typically tolerated. But pointing a camera at a specific person, filming someone without their knowledge, or recording a conversation between others in a public park all carry legal risk.

Restricted Locations

Oman imposes additional restrictions on recording near certain locations:

• Government buildings are off-limits for photography and recording
• Military installations and defense facilities cannot be photographed
• Ports and airports are restricted areas for recording
• Police vehicles and military equipment may not be photographed

Violations of these restrictions fall under national security provisions and can carry penalties separate from and in addition to the recording laws discussed above.

Tourists and Visitors

Visitors to Oman should be aware that photographing local residents without their permission is both a legal violation and a cultural offense. Oman's social norms place a high value on personal privacy, particularly regarding women and families. Travelers should always ask before photographing individuals, especially in traditional markets (souqs), residential areas, and religious sites.

Workplace Recording and Surveillance

Employer Obligations

Omani law does not provide employers with a blanket right to record employees. The privacy protections in the Basic Law, the Cybercrime Law, and the PDPL all apply in the workplace.

Employers who wish to implement recording or monitoring systems must:

• Obtain explicit consent from employees before installing audio recording equipment
• Provide clear written notice about the scope, purpose, and duration of any monitoring
• Limit surveillance to legitimate business purposes such as security and safety
• Never record in private areas including restrooms, prayer rooms, and changing facilities
• Comply with the PDPL's requirements for processing employee personal data

CCTV in the Workplace

Video surveillance in Omani workplaces is subject to both the PDPL and general privacy principles. Employers may install CCTV cameras in common areas for security purposes, provided employees are informed. Audio recording through CCTV systems requires separate justification and consent.

The PDPL's enforcement since February 2026 means that employers must now treat CCTV footage as personal data, subject to all the consent, purpose-limitation, and retention requirements of the law.

Employee Rights

Employers in Oman cannot:

• Record employees' personal phone calls
• Monitor private conversations without consent
• Share employee recordings with third parties without legal basis
• Reveal confidential employee information obtained through surveillance

Violations of employee privacy can result in criminal charges under the Cybercrime Law and civil liability under the PDPL.

Penalties Summary

Offense	Law	Prison Term	Fine
Recording/photographing without consent using IT tools	Cybercrime Law Art. 16 (RD 12/2011)	1-3 years	OMR 1,000-5,000 (~$2,600-$13,000)
Eavesdropping or unauthorized recording	Penal Law (RD 7/2018)	Up to 3 years	Varies
Intercepting telecommunications	Telecom Act Art. 55 (RD 30/2002)	Up to 1 year	Up to OMR 5,000 (~$13,000)
Recording without Public Prosecutor permission	Criminal Procedures (RD 97/99)	Varies	Varies
PDPL individual violations	PDPL (RD 6/2022)	N/A	OMR 500-20,000 (~$1,300-$52,000)
PDPL corporate violations	PDPL (RD 6/2022)	N/A	OMR 5,000-100,000 (~$13,000-$260,000)
Cross-border data transfer violations	PDPL (RD 6/2022)	N/A	OMR 100,000-500,000 (~$260,000-$1.3M)

Business Compliance Checklist

Organizations operating in Oman should take these steps to comply with the country's recording and data protection laws:

• Audit all recording systems. Identify every system that captures audio or video, including phone systems, CCTV, conferencing platforms, and customer-facing tools.
• Obtain explicit consent before recording any call or meeting. Consent must be clear, informed, and documented. A pre-recorded message at the start of a call does not satisfy the requirement unless the caller actively agrees.
• Appoint a Data Protection Officer. Under the PDPL, organizations processing personal data should designate a responsible individual for compliance oversight.
• Register with the Ministry of Transport, Communications and Information Technology. The PDPL requires data controllers to comply with the Ministry's regulatory framework.
• Restrict surveillance to security purposes. Do not install recording equipment in private areas, and limit audio recording to situations where explicit consent has been obtained.
• Implement data retention policies. Establish clear rules for how long recordings are kept and when they are deleted, consistent with PDPL principles of purpose limitation.
• Conduct privacy impact assessments. Before deploying any new recording or monitoring system, evaluate its legal compliance and privacy implications.
• Train employees on recording restrictions. Staff should understand that photographing colleagues, recording meetings without consent, or sharing images of others on social media can result in criminal prosecution.
• Review cross-border data transfers. If recordings or personal data are stored on servers outside Oman or shared with entities abroad, ensure the transfer complies with the PDPL's strict cross-border provisions. Violations carry fines up to OMR 500,000.