The rules for AI customer contact in Oman.

The Personal Data Protection Law at a glance

Oman's Personal Data Protection Law was issued by Royal Decree 6/2022 in February 2022 and entered into force on 13 February 2023, replacing the older data provisions of the Electronic Transactions Law. It is supervised by the Ministry of Transport, Communications and Information Technology (MTCIT), which issued the law's Executive Regulations by Ministerial Decision 34/2024 with a transition period for existing controllers to bring their processing into line.

The law is consent-centric: as a general rule, personal data may be processed only with the express consent of the data subject, unless another lawful basis in the law applies. Consent must be informed, and controllers must be able to show when and how it was given.

What counts as personal data on a call

A recorded phone conversation is personal data: the caller's voice, phone number, name, and anything they disclose during the conversation. Transcripts, sentiment scores, and CRM notes derived from the call are personal data too. If your AI answers calls, you are processing personal data from the first second, which is why disclosure and consent belong at the very start of the call flow.

• Voice recordings and their transcripts
• Caller line identity and contact details
• Details disclosed in conversation: orders, addresses, complaints
• Derived data: sentiment, intent, categorisation

Sensitive data needs a permit

Processing of sensitive categories, such as health data, genetic and biometric data, and data about criminal convictions, requires a permit from the ministry under the law. This matters for clinics, insurers, and any AI flow that captures medical details: design the conversation so sensitive data is collected only where genuinely needed, and make sure your processing is covered before launch.

Data subject rights your flows must honour

Callers in Oman hold enforceable rights over their data. Your AI contact flows, and the systems behind them, should be able to act on a request without drama.

• Access: a copy of the personal data you hold about them
• Correction: fixing inaccurate or outdated records
• Erasure: deletion when processing is no longer justified
• Transfer: receiving their data in a usable form
• Withdrawal: revoking consent as easily as it was given

Breaches, transfers, and penalties

Controllers must notify the ministry, and in qualifying cases the affected individuals, of personal data breaches within the timeframes set by the Executive Regulations. Transfers of personal data outside Oman are permitted only under the law's conditions, which is why keeping processing inside the Sultanate is the simplest compliant architecture: no transfer, no transfer problem.

Violations carry administrative fines that can reach into the hundreds of thousands of rials, alongside possible criminal liability for the most serious offences. The cost of designing compliance in from day one is trivial by comparison.

Telemarketing and outbound AI calls

Outbound customer contact in Oman sits under more than one instrument: the Personal Data Protection Law for the data itself, telecommunications regulation for how you use the network, and consumer protection law for honest dealing. Unsolicited marketing messages are regulated, and the safe pattern for AI campaigns is permission-based contact with clean records.

• Call people who have a relationship with you or gave consent
• Say plainly, at the start, that an AI assistant is calling and why
• Offer an easy opt-out and honour it permanently
• Keep consent and contact logs you can produce on request
• Avoid prayer times, late evenings, and Ramadan daytime fasts

The etiquette layer: how Oman expects to be called

Beyond the statutes, Omani business culture has its own rules. Greetings matter, and an abrupt robotic opener costs goodwill that a polite salaam preserves. Calls land best between mid-morning and early evening, never during Friday prayers, and campaign pacing should respect Ramadan and Eid schedules. An AI agent that follows these norms in Omani Arabic does not just comply, it represents your brand well.

How AI Customer Care implements all of this

AI Customer Care was built in Oman, for these rules. Disclosure lines open every AI conversation, consent capture is logged with timestamps, opt-outs propagate across every channel instantly, and calling windows enforce Omani hours including seasonal schedules. All recordings, transcripts, and customer records are processed and stored on infrastructure inside the Sultanate, so cross-border transfer questions simply never arise.