Which Sensitive Personal Data Needs a Ministry Permit?

Every day, a clinic call desk writes down things the data protection law treats as the most private information a person has: a pregnancy, a blood sugar reading, a referral to a psychiatrist. That kind of sensitive personal data cannot legally be processed without a permit from the Ministry of Transport, Communications and Information Technology, and the fine for skipping it starts at OMR 15,000. So which data is on that list, does the salary file in HR count, and what does extra care actually look like on a busy phone line?

What the law singles out as sensitive personal data

The Personal Data Protection Law protects all personal data, meaning anything that identifies a person directly or indirectly: a name, a phone number, a voice on a recording. But one short article sets aside a special group. Processing it is prohibited unless the business holds a permit from the ministry, which is the regulator for the law.

• Genetic data: characteristics found by analysing a biological sample, such as a DNA test.
• Biometric data: fingerprints, face scans and other physical or behavioural traits measured by technical processing.
• Health data: anything about physical, mental or psychological health. Since September 2026 the definition also covers health care services a person received, where they reveal their condition.
• Racial origin and sex life.
• Political or religious opinions and philosophical beliefs.
• Criminal convictions and security measures.

Children's data sits under a separate rule: it needs a guardian's approval unless the processing serves the child's best interest. That matters to colleges, training institutes and paediatric clinics, where the caller is often a parent speaking for a child.

If your call desk writes down why a patient is calling, your call desk is processing health data, whether or not anyone there thinks of it that way.

Where it hides in an ordinary working day

Most managers picture sensitive data as the medical file in a locked room. In practice it spills onto the front line, because customers explain themselves when they call.

So does a salary file count?

Not as sensitive data. Salaries, bank statements and credit history do not appear on the permit list, which surprises many HR teams. They are still personal data, so the normal duties apply: a clear purpose, consent or another lawful basis, sound security, a breach report to the ministry within 72 hours, and erasure once the purpose is finished.

Employers also got some room in September 2026. An amendment lets a business process its own staff's data for internal operations without the permit, provided it stays within the law and gets the employee's written consent before passing that data to anyone outside. So the fingerprint clock at your staff entrance is treated differently from a patient's file, but HR still cannot send a nurse's sick note to an outside party without her signature. The exact conditions are worth reading with your adviser.

What the permit asks of you

The ministry's personal data protection services page lists the permit application and what to attach:

• The application form, in Arabic or English, with the name and contact details of your data protection officer (the person inside the business responsible for data protection, often an existing employee).
• Your personal data protection policy, built on the ministry's guide and template.
• The precautions you will take if the data is ever breached.

The ministry decides within 45 days of a complete file, and silence counts as refusal. A permit lasts up to five years. The grace period for getting compliant ended in February 2026, so an unpermitted health record today is live exposure, not homework.

Count the copies before you count the risk

Most clinic groups already hold a permit for their medical records system. The gap is usually the phone line, where health details land in places the permit file never described. Here is a composite example for a three-branch polyclinic group in Muscat. Swap in your own numbers.

The point is not the fine. Every extra place a story lands is another place to lock, describe and wipe. Cut the storage points from three to one and the same desk protects 3,432 copies instead of 10,296. How one desk actually did that comes next.

How one call desk shrank its sensitive data

Fatma, a composite patient services coordinator at that polyclinic group, ran the count with her own team. Symptoms lived in three places: the phone system's recordings, free-text booking notes and a pad of sticky notes beside every operator. Her fix took six weeks, not a new building.

1. Map it. One sheet: every channel, what health detail arrives, where it is stored, who can open it.
2. Check the permit covers the phone line. The purpose, systems and storage location in the permit file should include call recordings and the booking tool, not only the medical records system.
3. Ask for less. Operators pick a visit category (follow-up, new complaint, test results) instead of typing the caller's whole story. Clinical detail goes to the nurse line.
4. One place, not three. Sticky pads and personal WhatsApp went. Everything lands in the booking system.
5. Lock by role. Operators see the appointment and the category. Only clinical staff open the detail.
6. Delete on schedule. The amended law says data must be erased once its purpose ends, so recordings got a fixed retention period and an automatic purge.
7. Let automation write the note. When AI agents handle the routine booking calls, each conversation becomes a structured note rather than an operator's scribble at 8 pm. Agentic Customer Care by CustomerCare.OM, for example, keeps that call data hosted inside Oman, which makes the storage line on a permit form easy to answer.

A permit covers the systems you described to the ministry, not the sticky note beside the phone.

What this means for you

If you run a desk at a clinic, insurer, hotel or college, assume your phone line touches health data this week. Confirm your permit names the channels where it arrives, cut the number of places it lands, and give one person the data protection officer role in writing.

If you are the caller, you only need to share what helps the booking. You can ask a business what it holds about you, and if you believe your health details were mishandled, you can complain to the ministry within 30 days of finding out.

The bottom line

The data protection law guards every name and number, but it keeps its strictest rule for health, biometrics, beliefs and a few other categories. For a business with a busy phone line, the real risk sits at the call desk more than in the records room. Count where those stories land, shrink it to one place, and make sure your permit describes it.