The rules for automated customer messaging in Oman.

The Personal Data Protection Law at a glance

Oman's Personal Data Protection Law was issued by Royal Decree 6/2022 in February 2022 and entered into force on 13 February 2023, replacing the older data provisions of the Electronic Transactions Law. It is supervised by the Ministry of Transport, Communications and Information Technology, which issued the law's Executive Regulations by Ministerial Decision 34/2024 with a transition period for existing controllers.

The law is consent-centric. As a general rule, personal data may be processed only with the express consent of the data subject unless another lawful basis in the law applies, and consent must be informed and evidenced.

A chat transcript is personal data

It is easy to think of a chat window as less serious than a recorded phone call. Legally it is not. From the first message you are processing personal data, and a chat transcript usually contains more identifiable detail than a call, because customers paste order numbers, addresses, and photographs into it without thinking.

• The message content itself, in any language
• Phone number, name, and email attached to the conversation
• Attachments: photographs of documents, invoices, and premises
• Voice notes and their transcripts
• Derived data: sentiment scores, intent labels, lead scoring

Sensitive categories need a permit

Processing of sensitive categories, including health data, genetic and biometric data, and data about criminal convictions, requires a permit from the ministry. This is a live issue for clinics and insurers running a chatbot, because patients volunteer symptoms in a chat window whether you asked for them or not.

The practical answer is to design the conversation so sensitive data is not solicited, to escalate those conversations to a human immediately, and to make sure your retention settings do not keep what you did not need.

Say that it is an AI

There is no Omani statute that specifically mandates disclosing an automated agent in a chat window, but there are good reasons to do it anyway. It is consistent with the honest-dealing expectations of consumer protection law, it is what customers overwhelmingly say they prefer, and it removes any argument later about what they believed they were agreeing to.

In practice, disclosure costs nothing. Customers who are told plainly that they are talking to an assistant, and that a person is available, are measurably more patient with the conversation, not less.

• Open with a short, plain statement that this is an automated assistant
• Make the route to a human obvious at any point
• Confirm the same thing honestly if the customer asks outright

Rights your chat flows have to honour

Customers in Oman hold enforceable rights over their data, and a chatbot that cannot act on them is a liability rather than an asset. Your conversation records, tickets, and lead data all need to be reachable when a request arrives.

• Access: a copy of the personal data you hold about them
• Correction: fixing inaccurate or outdated records
• Erasure: deletion when processing is no longer justified
• Transfer: receiving their data in a usable form
• Withdrawal: revoking consent as easily as it was given

Breaches, transfers, and penalties

Controllers must notify the ministry, and in qualifying cases the affected individuals, of personal data breaches within the timeframes set by the Executive Regulations. Transfers of personal data outside Oman are permitted only under the law's conditions.

That last point is why data residency is the simplest architectural decision you can make. If processing never leaves the Sultanate, the transfer question never arises. Violations carry administrative fines that can reach into the hundreds of thousands of rials, alongside possible criminal liability for the most serious offences.

The WhatsApp Business Platform has its own rules

Separately from Omani law, WhatsApp imposes its own conditions on business messaging, and breaking them gets your number restricted regardless of whether you were compliant with the statute. Businesses may reply freely for 24 hours after a customer's last message. Outside that window, only templates registered and approved in advance may be sent.

Templates are reviewed, and promotional content sent to people who did not opt in is the fastest route to losing the channel. Reminders, confirmations, and service updates to existing customers are exactly what the platform is designed for.

• Free-form replies only inside the 24-hour service window
• Pre-approved templates outside it, no exceptions
• Opt-in recorded before any outbound message
• Opt-out honoured immediately and permanently
• No messaging to purchased or scraped lists

The etiquette layer: how Oman expects to be messaged

Beyond the statutes and the platform rules, there is local custom. A greeting matters, and an abrupt opener in a chat window reads as rudely in Arabic as it would in person. Automated messages should hold outside working hours unless genuinely urgent, and campaign pacing should respect Friday prayers, Ramadan daytime fasting, and Eid.

An assistant that observes these norms in Omani Arabic is not merely compliant. It is representing your business the way a good employee would.

How Chatbot.OM implements all of this

Chatbot.OM was built in Oman, for these rules. Disclosure opens every conversation, consent is captured with timestamps, opt-outs propagate across channels immediately, and messaging windows respect Omani working hours and the seasonal calendar. Sensitive topics are configured to escalate rather than to be answered.

All conversations, transcripts, attachments, and derived data are processed and stored on infrastructure inside the Sultanate, so cross-border transfer questions simply do not arise. Organisations with stricter requirements can run the whole thing on their own infrastructure instead.