Your front desk has recorded customer calls for years, probably without a second thought. Since Oman's data protection law moved into full enforcement this year, an unannounced recording can turn into a complaint to the regulator. The fix costs one afternoon of a supervisor's time, not a new system.
The recording that already happens
Walk into any hotel front office, polyclinic call desk or dealership service line and the same thing is quietly happening. The phone system, the call center software, sometimes even the WhatsApp Business line, is already recording the conversation for training or dispute records. Almost nobody says so out loud.
Aisha, who coordinates the service line for a car dealership in Seeb, only noticed the gap when a customer asked where his recorded call about a warranty repair was stored. Nobody on her team had a ready answer. That single question is what pushed her to review the whole call flow.
What the law actually requires
Oman's Personal Data Protection Law governs how a business collects, stores and uses information that identifies a person, and a recorded voice counts. The law has applied since February 2023, and the compliance grace period that let businesses catch up ended in February 2026. Since then the regulator, the Ministry of Transport, Communications and Information Technology, can act on complaints from customers, not just review paperwork on request.
A recorded call becomes personal data the moment it is saved, whether it sits on the phone system's server, a laptop backup or a voice note. To record it lawfully, a business needs a reason the law recognizes, and for a normal customer call that reason is almost always the caller's explicit consent.
A recorded voice becomes personal data the moment it is saved, the same as a name on your customer list.
Telling the caller is not optional
Consent does not need to be a signed form. Oman's rules let a business obtain consent by any method it determines, so a spoken line at the start of the call, or a recorded announcement before the ringing stops, satisfies the law as long as the caller understands what is happening and can say no. Timing is what matters most.
Telling a caller after the call has already been recorded and saved does not count. Callers also keep the right to object, ask a business to delete a recording, or complain to the ministry within 30 days of discovering that no one told them. That deadline is shorter than most service desks assume.
The fix that fits in a week
None of this needs new software. Retrofitting a compliant recording process into a desk that already answers dozens of calls a day is closer to an afternoon of paperwork than a system overhaul. Here is what a composite example, Al Waha Polyclinic, worked through in one week.
| Step | Who owns it | Time needed | Approx. cost |
|---|---|---|---|
| Add one line to the greeting: this call may be recorded for training, say no to opt out | Front office lead + phone vendor | 2 hours | OMR 15 |
| List every place a recording lands: call system, backup drive, WhatsApp voice notes | IT support | Half a day | OMR 80 |
| Set a retention limit, for example delete after 90 days unless a complaint is open | Operations manager | 1 hour meeting | OMR 0 |
| Write a one page rule for who can play back a recording and why | HR or compliance lead | 2 hours | OMR 0 |
| Brief the team on the 30 day complaint window and how to log an opt out | Team huddle | 30 minutes | OMR 0 |
The whole exercise cost Al Waha under OMR 100 and one working week, spread across people who already held these jobs. No consultant, no new license.
We recorded every guest call for years. Nobody said so until we added one line to the greeting.
Where the recording lives and who can play it back
Storage matters as much as consent. A recording anyone in the office can open from a shared folder is not being handled responsibly, even if the caller agreed to it. Limit playback to people who genuinely need it, a supervisor resolving a dispute or a trainer reviewing a call, and keep a short log of who opened which recording and when.
What this means for you
- If your team already records calls, check today whether the greeting or IVR message actually says so out loud.
- If a customer asks whether their call was recorded and where it lives, you should have an answer within minutes, not days.
- Set a retention limit in writing, even a simple one, and delete recordings on schedule instead of keeping everything indefinitely.
- Keep a short log of who accessed a recording and why, in case the ministry or the customer ever asks.
Do I need written consent to record a customer call?
No. Oman's rules let you obtain consent by any method you determine, so a clear spoken notice at the start of the call is enough, as long as the caller can say no.
Can a customer make me delete a recording?
Yes. They can ask, and if there is no ongoing dispute or legal reason to keep it, you should honor the request and confirm once it is done.
What if we already have months of recordings with no disclosure at all?
Start disclosing today, set a deletion date for the older batch, and do not wait for a complaint to fix the greeting.
The bottom line
Recording a customer call was never the problem. Not telling the caller is. Add one honest sentence to your greeting, decide who can hear the recording and for how long, and the biggest compliance gap on most service desks closes within a week.
Sources checked for this article
- MTCIT: Personal Data Protection Law (oman-official)
- MTCIT: Personal Data Protection governance page (oman-official)
- CMS Law Now: Oman personal data protection law entering the enforcement phase (analysis)
Practical information, not legal advice. Rules and dates were checked on 9 September 2026; verify current official positions before acting.
