Oman Recording Laws: All-Party Consent Rules and Penalties (2026)

Oman Recording Laws: All-Party Consent Rules and Penalties (2026)

Oman enforces an all-party consent standard for recording. Recording any phone call, in-person conversation, or private exchange without the explicit permission of every participant is a criminal offense under the Cybercrime Law (Royal Decree 12/2011, Article 16), the Penal Law (Royal Decree 7/2018), and since February 5, 2026, the Personal Data Protection Law (Royal Decree 6/2022).

Information last verified on 2026-05-15. This article has not yet been reviewed by a licensed lawyer.

Jurisdiction scope: This article addresses recording consent law in the Sultanate of Oman under the Cybercrime Law (RD 12/2011), the Penal Law (RD 7/2018), the Personal Data Protection Law (RD 6/2022), the Criminal Procedures Law (RD 97/99), and the Basic Statute (RD 6/2021). It does not address UAE, Saudi Arabian, or other GCC recording laws. For those, see the world recording laws hub.

Is Oman an All-Party Consent State? Quick Answer

Oman is an all-party consent jurisdiction for recording. No person may record a telephone call, a face-to-face conversation, or any private exchange without the knowledge and explicit permission of every participant. This rule is not limited to one type of recording technology or one statute. It flows from three independent legal sources that have operated simultaneously since at least 2011. Article 16 of the Cybercrime Law (Royal Decree 12/2011) makes it a criminal offense to photograph or record any person using information technology tools without their consent. The Penal Law (Royal Decree 7/2018) separately criminalizes eavesdropping and unauthorized recording in both digital and non-digital contexts. And the Personal Data Protection Law (Royal Decree 6/2022), which reached full enforcement on February 5, 2026, adds a data-processing layer: any recording that captures identifiable personal data also triggers consent, transparency, and retention obligations. A recording made without consent is simultaneously a criminal act under at least two statutes and an unlawful data-processing event under the PDPL.

The Cybercrime Law: Royal Decree 12/2011

What Article 16 Prohibits

Article 16 of the Cybercrime Law is the provision most directly relevant to recording. It criminalizes using information technology tools to violate the privacy of an individual's personal or family life.

The prohibited acts include:

• Photographing any person using electronic devices without their consent
• Recording audio of any person using electronic devices without their consent
• Publishing or distributing recordings, photographs, or news related to someone's private life, even if the content is factually accurate
• Insulting or defaming individuals through recorded or published material

The scope of Article 16 is notably broad. It does not distinguish between recordings made in private and those made in public. It does not matter whether the content is true. The act of capturing someone's image or voice through technology without permission is itself the offense.

Penalties Under Article 16

A conviction under Article 16 carries:

• Imprisonment for not less than one year and not more than three years
• A fine of not less than OMR 1,000 and not more than OMR 5,000 (approximately USD $2,600 to $13,000)
• Or either of these two penalties

The minimum one-year prison sentence makes this a serious offense under Omani law. Courts have discretion to impose the prison term, the fine, or both, depending on the circumstances.

How the Cybercrime Law Applies to Modern Devices

Article 16 uses the phrase "information technology tools," which covers a wide range of current and emerging devices. The provision covers:

• Smartphones and their built-in cameras and microphones
• Laptops and tablets with recording capabilities
• Smartwatches and wearable devices
• Dedicated audio recorders and cameras
• Software applications that capture audio, video, or screenshots
• CCTV and surveillance systems operated without proper authorization

The law was written to be technology-neutral. As new recording devices enter the market, they fall under Article 16 without the need for legislative amendment.

The Penal Law: Royal Decree 7/2018

Privacy Protections in the Penal Code

Oman's Penal Law, enacted through Royal Decree 7/2018 and effective since January 15, 2018, contains provisions that criminalize privacy invasion through eavesdropping and unauthorized recording. These provisions operate independently of the Cybercrime Law, meaning a single act of unauthorized recording can theoretically violate both statutes.

The Penal Law criminalizes:

• Intentional eavesdropping on telephone calls or private conversations
• Recording or transmitting private conversations using any electronic device
• Taking or sharing photographs of a person or group of people without permission

Penalties under the Penal Law for these offenses can reach up to three years in prison.

How the Penal Law Differs from the Cybercrime Law

The two statutes overlap but are not identical. The Cybercrime Law specifically targets conduct carried out through information technology. The Penal Law covers a broader range of conduct, including non-digital eavesdropping and surveillance.

In practice, prosecutors have discretion to charge under either or both laws depending on the facts. A person who uses a smartphone to secretly record a private conversation could face charges under both Article 16 of the Cybercrime Law and the relevant privacy provisions of the Penal Law.

The 2025 Amendment

Royal Decree 11/2025 amended certain provisions of the Penal Law, primarily related to sentencing procedures and the suspension of penalties. While this amendment did not directly alter the privacy or recording provisions, it adjusted how courts may implement suspended sentences for various offenses, which could affect sentencing outcomes in recording-related cases.

The Personal Data Protection Law: Royal Decree 6/2022

A New Layer of Protection

Oman's Personal Data Protection Law (PDPL), issued under Royal Decree 6/2022, represents the most significant addition to the country's privacy framework in recent years. The law was published in February 2022, and after multiple extensions of the compliance transition period, it became fully enforceable on February 5, 2026. The Ministry of Transport, Communications and Information Technology (MTCIT) is the competent enforcement authority.

The PDPL does not replace the Cybercrime Law or the Penal Law. Instead, it adds a data-protection framework on top of the existing criminal provisions. For recording, this means that capturing someone's voice or image now triggers obligations under data protection law in addition to the criminal penalties that already existed.

Consent Requirements Under the PDPL

The PDPL establishes explicit consent as the primary legal basis for processing personal data. Under the law:

• Processing personal data is not permitted except within the framework of transparency, honesty, and respect for human dignity
• The data subject must provide explicit consent before any processing occurs
• The request for consent must be written in a clear, explicit, and understandable manner (typically in Arabic, Oman's official language)
• Consent must be given voluntarily and without coercion
• The data subject has the right to revoke consent at any time

Audio recordings, photographs, and video footage all constitute personal data under the PDPL when they identify or can be used to identify an individual. This means that recording a conversation is a form of data processing that requires prior consent.

Executive Regulations (Ministerial Decision 34/2024)

The Executive Regulations to the PDPL, issued through Ministerial Decision 34/2024, provide additional detail on what constitutes valid consent. Under Article 4 of the regulations, consent must be:

• Issued by a person with full legal capacity
• Given in a clear manner and without coercion
• Documented in writing, electronically, or by any other means specified by the data controller

These requirements raise the bar for businesses that record phone calls or meetings. A vague disclaimer or a buried clause in terms of service is unlikely to satisfy the PDPL's standard for "clear, explicit, and understandable" consent.

PDPL Enforcement Obligations (Effective February 2026)

Since full enforcement began on February 5, 2026, organizations that record conversations or capture personal data in Oman must also:

• Appoint a Data Protection Officer (DPO): All data controllers must appoint a DPO and make the DPO's contact details publicly available. The MTCIT has expressed a preference for the DPO to be physically located in Oman to facilitate timely regulatory communication.
• Notify MTCIT within 72 hours of any personal data breach that may pose a risk to data subjects' rights. The notification must include the nature, impact, and mitigation measures of the breach.
• Respond to data subject requests within 45 days in writing. Requests may include withdrawal of consent, correction, deletion, or portability of recorded data.
• Obtain a Ministry permit before processing sensitive data, including biometric data, genetic data, health data, and data related to racial origin, sexual life, or criminal convictions (PDPL Article 5). Processing biometric recordings (such as voice prints or facial recognition footage) without this permit is prohibited.
• Maintain a record of processing activities and provide a copy to MTCIT upon request.

Civil Liability Under the PDPL

The PDPL creates a civil liability framework alongside criminal penalties. The processor of personal data acts as the agent of the controller for civil and administrative liability purposes, without prejudice to the processor's separate criminal liability for violations. Data subjects who suffer harm from unlawful recording or processing of their personal data may seek compensation through this mechanism.

PDPL Penalties

The PDPL introduces a tiered penalty structure that varies by the type of violation:

The maximum OMR 500,000 fine (approximately USD $1.3 million) for unauthorized cross-border data transfers is by far the heaviest financial penalty in Oman's privacy framework.

Additional administrative penalties include warnings, suspension of operating permits, administrative fines up to OMR 2,000, and cancellation of permits.

The Constitutional Foundation: Article 30 of the Basic Statute

Oman's Basic Statute, set out in Royal Decree 6/2021 (which superseded the original Royal Decree 101/96), serves as the country's constitution. Article 30, located in the chapter on Public Rights and Duties, guarantees the privacy of all communications.

Article 30 states that the freedom of correspondence by post, telegraph, telephone, or other means of communication is guaranteed. It is unlawful to monitor, search, disclose the confidentiality of, delay, or confiscate such communications except in cases specified by law and in accordance with procedures prescribed by law.

This constitutional provision forms the foundation upon which every recording-related statute in Oman is built. When courts interpret the Cybercrime Law, the Penal Law, or the PDPL, they do so in light of Article 30's broad guarantee of communications privacy.

The Criminal Procedures Law: When Authorities Can Record

While private recording requires consent, Omani law provides a narrow exception for law enforcement.

Article 90 of the Criminal Procedures Law (Royal Decree 97/99) establishes that conversations in private places may not be recorded, telephones may not be tapped, and dialogue may not be recorded without the permission of the Public Prosecutor.

The Public Prosecutor may grant permission only when:

• The recording would produce useful evidence
• There is a suspected offense or misdemeanor punishable by imprisonment exceeding three months
• The permission is issued in writing with stated reasons
• The authorization does not exceed 30 days (subject to renewal for similar periods)

This provision confirms that even the government cannot freely wiretap or record. Law enforcement must go through the Public Prosecutor and demonstrate a legitimate investigative need.

The Telecommunications Act: Royal Decree 30/2002

Article 55 of the Telecommunications Act provides an additional layer of protection specific to electronic communications infrastructure. Under this provision, any person who intercepts telecommunications without the written approval of the Telecommunications Regulatory Authority (TRA) and outside what is permitted by law faces:

• Imprisonment for up to one year
• A fine of up to OMR 5,000

This provision targets technical interception of communications networks rather than the act of pressing record on a phone. It is primarily relevant to telecommunications companies, technology providers, and anyone who might attempt to intercept data traveling across Oman's communications infrastructure.

Phone Calls and In-Person Conversations

Phone Call Recording

Recording phone calls in Oman without the consent of all parties is illegal under both the Cybercrime Law and the Penal Law. The prohibition applies to:

• Personal phone calls between private individuals
• Business and commercial calls
• VoIP and internet-based calls (WhatsApp, Zoom, Microsoft Teams, and similar platforms)
• Calls recorded by automated systems, call center software, or CRM platforms

There is no exception for recording your own calls. Even if you are a direct participant in the conversation, secretly recording it violates Omani law.

Under the 1999 Criminal Procedures Code, recorded calls can only be used as personal references. They cannot serve as evidence in court proceedings unless all parties consented to the recording or the recording was authorized by the Public Prosecutor.

In-Person Conversations

The same all-party consent requirement applies to face-to-face conversations. Secretly recording a meeting, a negotiation, a personal discussion, or any exchange that takes place in a private setting is a criminal offense.

The law does not require the conversation to take place in a traditionally "private" location like a home or office. A conversation between two people at a restaurant, in a car, or at a shopping center can qualify as private if the participants have a reasonable expectation that the exchange is not being monitored.

Recording Police and Security Forces

Recording or photographing police officers, military personnel, security checkpoints, military vehicles, or their activities is a serious legal risk in Oman. The Royal Oman Police has confirmed that such recordings are illegal, citing state security provisions of the Penal Code in addition to the Cybercrime Law.

Violations can be prosecuted under Article 89 of the Penal Code, which addresses conduct affecting state security, as well as under Article 16 of the Cybercrime Law. Penalties for recording security forces can include imprisonment of one to three years and fines of OMR 1,000 to OMR 3,000.

The prohibition extends to sharing such recordings on social media. Sending or posting video footage of police or military activity can independently constitute a criminal offense under the Information Technology Law.

Watch out: Even incidental recordings that happen to capture a police checkpoint, military convoy, or security installation in the background can attract legal scrutiny. If you are filming in a public area and a security operation enters your frame, stop recording immediately.

Voyeurism and Hidden Cameras

Oman's recording laws address voyeurism through the Cybercrime Law's broad prohibition on non-consensual capture of images and audio. Article 16 of the Cybercrime Law covers any act of photographing or recording a person using electronic devices without their consent. This provision applies regardless of the setting and regardless of whether the victim is aware of the recording.

Hidden cameras installed in private spaces (changing rooms, bathrooms, hotel rooms, private offices) without the occupant's knowledge fall squarely within Article 16's prohibition. A conviction can result in one to three years imprisonment and fines of OMR 1,000 to OMR 5,000.

The Penal Law reinforces this protection. Its privacy provisions criminalize surveillance and unauthorized recording in both digital and non-digital forms, covering cases where the voyeuristic device is not connected to the internet or does not use standard IT tools.

Under the PDPL, footage captured through hidden cameras constitutes personal data that was processed without consent. If that footage identifies an individual, the act also violates the PDPL's explicit consent requirement and carries additional administrative fines.

Practical implications:

• Hotel guests who discover hidden cameras have criminal recourse under both the Cybercrime Law and the Penal Law
• Businesses that install hidden cameras in employee restrooms, prayer rooms, or changing facilities violate both criminal law and the PDPL
• Anyone who shares voyeuristic recordings faces additional prosecution under Article 16's prohibition on distribution, even if the sharing occurs outside Oman

Deepfakes and AI-Generated Recordings

Oman does not have a dedicated statute targeting deepfakes or AI-generated audio-visual content as of May 2026. Instead, the existing legal framework applies to AI-generated recordings through several overlapping provisions.

Cybercrime Law coverage: Article 16 of the Cybercrime Law prohibits publishing or distributing any recording or image that violates an individual's privacy, even if the content is factually accurate. A deepfake video or AI-cloned voice recording that uses a real person's likeness without their consent violates Article 16 regardless of whether it contains true or false information. The key element is the absence of consent.

PDPL coverage for AI processing: Under Article 5 of the PDPL, biometric data is classified as sensitive personal data. Voice prints, facial geometry data, and any other biometric identifiers used to generate AI voice clones or deepfake facial animations cannot be processed without both explicit consent and a permit from the MTCIT. Processing biometric data for AI purposes without this permit is a prohibited act with significant financial penalties.

Defamation and public morality provisions: AI-generated content that defames an identifiable person or violates Oman's public morality standards can be prosecuted under Penal Law provisions that apply independently of the recording-consent framework.

Oman's 2025 National AI Policy: The MTCIT coordinates Oman's AI governance through the National Program for Artificial Intelligence and Advanced Digital Technologies. The 2025 National AI Policy establishes a risk-based governance framework applicable to public entities and relevant private-sector actors, but it does not create specific deepfake criminal offenses. AI systems that process personal data remain subject to the PDPL regardless of this policy.

The practical implication for content creators and businesses is that generating or distributing any AI-produced content that uses a real person's voice, face, or other biometric characteristics without their consent exposes them to criminal liability under the Cybercrime Law and potential administrative penalties under the PDPL.

Cross-Border Recording and International Calls

Recording International Calls

The all-party consent requirement applies to international telephone calls originating from or received in Oman. If one party is in Oman, Omani law governs that party's obligations. Secretly recording a call with a party in another country, from within Oman, violates Article 16 of the Cybercrime Law and the Penal Law.

The fact that the other party's jurisdiction may permit one-party consent recording does not provide a defense under Omani law. The Omani party to the call is subject to Omani criminal law regardless of where the other participant is located.

Cross-Border Data Transfers Under the PDPL

When a recording is made in Oman and the audio or video data is stored on servers outside the country (for example, in a cloud system hosted in a foreign jurisdiction), or shared with entities abroad, the PDPL's cross-border transfer provisions apply.

Under the PDPL and its Executive Regulations:

• Explicit consent is required from the data subject before transferring their personal data outside Oman
• The recipient jurisdiction must provide protections equivalent to those of the PDPL
• Transfers of sensitive data (including biometric recordings) may require prior approval from Oman's Cyber Defence Centre
• Fines for unauthorized cross-border transfers that cause harm range from OMR 100,000 to OMR 500,000 (approximately USD $260,000 to $1.3 million)

Businesses that route customer call recordings through overseas call centers, store employee surveillance footage on foreign cloud servers, or share recorded meetings with international partners must ensure these transfers satisfy the PDPL's cross-border requirements.

Recordings Brought Into Oman

Recordings made legally in another country (for example, a lawfully obtained one-party-consent recording from the United States) may still pose legal risks if played, shared, or used in Oman in a way that violates Omani privacy law. The Cybercrime Law's prohibition on publishing or distributing recordings without consent applies to distribution that occurs within Oman, regardless of where the recording was made.

Public Spaces: Restrictions and Risks

General Public Recording

Oman's recording laws extend into public spaces. Article 16 of the Cybercrime Law does not contain an exemption for recordings made in public areas. Photographing or recording a specific individual in a public space without their consent can trigger criminal liability.

Practical enforcement is more nuanced. General photography of landscapes, architecture, and large crowds where no individual is the focal point is typically tolerated. But pointing a camera at a specific person, filming someone without their knowledge, or recording a conversation between others in a public park all carry legal risk.

Restricted Locations

Oman imposes additional restrictions on recording near certain locations:

• Government buildings are off-limits for photography and recording
• Military installations and defense facilities cannot be photographed
• Ports and airports are restricted areas for recording
• Police vehicles and military equipment may not be photographed

Violations of these restrictions fall under national security provisions and can carry penalties separate from and in addition to the recording laws discussed above.

Tourists and Visitors

Visitors to Oman should be aware that photographing local residents without their permission is both a legal violation and a cultural offense. Oman's social norms place a high value on personal privacy, particularly regarding women and families. Travelers should always ask before photographing individuals, especially in traditional markets (souqs), residential areas, and religious sites.

Workplace Recording and Surveillance

Employer Obligations

Omani law does not provide employers with a blanket right to record employees. The privacy protections in the Basic Statute, the Cybercrime Law, and the PDPL all apply in the workplace.

Employers who wish to implement recording or monitoring systems must:

• Obtain explicit consent from employees before installing audio recording equipment
• Provide clear written notice about the scope, purpose, and duration of any monitoring
• Limit surveillance to legitimate business purposes such as security and safety
• Never record in private areas including restrooms, prayer rooms, and changing facilities
• Comply with the PDPL's requirements for processing employee personal data, including appointing a DPO

CCTV in the Workplace

Video surveillance in Omani workplaces is subject to both the PDPL and general privacy principles. Employers may install CCTV cameras in common areas for security purposes, provided employees are informed. Audio recording through CCTV systems requires separate justification and consent.

Since February 2026, employers must treat CCTV footage as personal data subject to all PDPL consent, purpose-limitation, and retention requirements. If CCTV footage captures biometric-level data (for example, facial recognition enabled cameras), the employer must also obtain an MTCIT permit under PDPL Article 5 before deploying the system.

Employee Rights

Employers in Oman cannot:

• Record employees' personal phone calls
• Monitor private conversations without consent
• Share employee recordings with third parties without legal basis
• Reveal confidential employee information obtained through surveillance

Violations of employee privacy can result in criminal charges under the Cybercrime Law and civil liability under the PDPL.

Penalties Summary

Business Compliance Checklist

Organizations operating in Oman should take these steps to comply with the country's recording and data protection laws:

• Audit all recording systems. Identify every system that captures audio or video, including phone systems, CCTV, conferencing platforms, and customer-facing tools.
• Obtain explicit consent before recording any call or meeting. Consent must be clear, informed, and documented in Arabic. A pre-recorded message at the start of a call does not satisfy the requirement unless the caller actively agrees.
• Appoint a Data Protection Officer. All organizations processing personal data must designate a DPO and make the DPO's contact information publicly available. The MTCIT prefers the DPO to be physically located in Oman.
• Obtain an MTCIT permit before processing sensitive data. Under PDPL Article 5, biometric recordings (voice prints, facial recognition, fingerprints), health data, and genetic data require a Ministry permit before processing begins.
• Implement 72-hour breach notification procedures. If a data breach involving recordings or other personal data occurs, the MTCIT must be notified within 72 hours with details on the nature, impact, and mitigation of the breach.
• Establish a 45-day data subject response process. Data subjects have the right to request withdrawal of consent, correction, deletion, or portability of their recorded data. Responses must be provided in writing within 45 days.
• Restrict surveillance to security purposes. Do not install recording equipment in private areas, and limit audio recording to situations where explicit consent has been obtained.
• Implement data retention policies. Establish clear rules for how long recordings are kept and when they are deleted, consistent with PDPL principles of purpose limitation.
• Conduct privacy impact assessments. Before deploying any new recording or monitoring system, evaluate its legal compliance and privacy implications. Biometric systems require a Ministry permit assessment.
• Train employees on recording restrictions. Staff should understand that photographing colleagues, recording meetings without consent, or sharing images of others on social media can result in criminal prosecution.
• Review cross-border data transfers. If recordings or personal data are stored on servers outside Oman or shared with entities abroad, ensure the transfer complies with the PDPL's strict cross-border provisions, including explicit data subject consent and equivalent-protection verification. Violations carry fines up to OMR 500,000.
• Evaluate cloud storage and conferencing platforms. If a platform stores recordings on overseas servers, a cross-border transfer is occurring. Review your vendor contracts for PDPL compliance warranties.

Disclaimer

This article provides general legal information about recording laws in the Sultanate of Oman. It is not legal advice and does not create an attorney-client relationship. The information reflects Omani statutes and publicly available regulatory guidance as of May 15, 2026. Laws change; enforcement priorities evolve. Readers who face a recording-related legal issue in Oman should consult a lawyer licensed to practice in the Sultanate of Oman for advice specific to their situation.

About the Author

[PLACEHOLDER: author roster pending]

Related Articles

• World Recording Laws Hub
• UAE Recording Laws
• Is It Illegal to Record Someone Without Their Consent?
• Can an Employer Record Conversations Without Consent?
• Data Privacy Laws Overview

---

Last updated: 2026-05-15. Statutes cited reflect their in-force version as of 2026-05-15.