What Can You Ask a Business About Your Data?

If a clinic scans your civil ID just to book a filling, or a dealership keeps your phone number for years after you sold the car, that is now something a law has an opinion about. Since February 2026, Oman's Personal Data Protection Law stopped being paperwork in a compliance folder and became something the regulator actively enforces. This week's question is the one nobody explains well: as the customer, what can you actually ask for?

The grace period is over

Oman's Personal Data Protection Law has applied since February 2023, but businesses were given time to get organised. That grace period, already extended once, ended on 5 February 2026. Since then, the Ministry of Transport, Communications and Information Technology, the regulator for this law, has been actively supervising, taking complaints and can penalise businesses that get it wrong. For you, that timing matters: a complaint you raise now lands with a regulator that is expected to act on it, not file it for later.

What counts as your personal data

Personal data is broader than most people assume. It is any information that can identify you, on its own or combined with something else a business already holds.

• Your name, civil ID or passport number, and phone number
• Your home address, delivery location or a saved GPS pin
• Health records, prescriptions and appointment history at a clinic or hospital
• Photos, ID scans and camera footage that shows your face
• Call recordings and chat messages, including your voice on a support line
• Vehicle registration, insurance and service history at a dealership

If a business can attach a piece of information to you specifically, the law treats it as your data, whether it lives in a spreadsheet, a phone system or a filing cabinet.

Before they collect anything

The law expects a business to ask, not just take. Before it processes your data, it is supposed to tell you certain things and, in most cases, get your consent first.

• Who is collecting the data and how to contact them
• Why they need it and what they plan to do with it
• Whether it will be shared with anyone else, and who
• That you can withdraw your consent at any time

For marketing messages specifically, consent has to be clear and on record, and a business must let you opt out immediately and at no cost, which matters given how many promotional texts land on phones here.

You do not need a lawyer to find out what a business knows about you: a written request and a 45-day countdown is the whole process.

Three things you can ask for

Once a business holds your data, the law gives you three practical levers.

1. Access: ask what data they hold on you, where it came from and who they have shared it with.
2. Correction: ask them to fix anything wrong, an old address, a misspelled name, a phone number that now belongs to someone else.
3. Deletion: ask them to erase data they no longer need, though they can refuse if they are legally required to keep it, such as tax or health records.

Once you ask in writing, the business has 45 days to respond under the executive regulation attached to the law. They can push back if a request is excessive or clearly meant to cause trouble, but a straightforward request should get a straightforward answer.

Multiply that by even four requests in a busy month, guests travelling around the Mawlid holiday for instance, and it is real staff time pulled off the front desk. That is the operational case for organised records, not just the legal one.

If a business ignores your request

If 45 days pass with no answer, or you think the response was wrong, you can complain to MTCIT. You have 30 days from when you discover the problem to file, using the ministry's official channel, and the ministry aims to decide within 60 days. Keep your written request and any reply as evidence, a screenshot of a chat message counts.

What this means for you

• Before you hand over your civil ID, phone number or health details, ask why the business needs it. That question is now a right, not a nuisance.
• Put every request in writing, an email or the same chat thread you already use, and keep a copy with the date.
• You can ask to see, correct or delete data held by a clinic, dealership, gym, insurer, or any business you have dealt with, even years ago.
• If a business is breached and your data is at risk, it owes you notice within 72 hours, without you having to ask.
• If 45 days pass with no answer, your next stop is a complaint to MTCIT, not silence.

For the business side reading this over a colleague's shoulder, the same clock cuts both ways: a system that keeps every call, chat and record inside Oman and can pull up one caller's full history in a few clicks turns a 45-day deadline into an easy afternoon instead of a scramble through three logins.

The bottom line

Oman's Personal Data Protection Law has applied since February 2023, but the grace period that let businesses catch up ended in February 2026. As a customer, you can now put a straightforward request in writing, ask a business to show you, fix or delete what it holds, and expect an answer within 45 days. That is a real deadline, not a suggestion, and it is worth using.