List your data
Forms, newsletter sign-ups, bookings, checkout and analytics all collect personal data. Write down what each collects, why and who sees it. Every other step builds on that inventory.
- Contact and booking forms
- Customer accounts and order history
- Analytics, cookies and ad pixels
- Applicant data from careers pages
Follow the law and its regulations
The law was issued by Royal Decree 6/2022. It covers lawful processing, consent, security and the rights of individuals, with details in its executive regulations. This is general guidance, not legal advice, so confirm current requirements with a lawyer working in Oman.
Be open and record consent
Publish a privacy notice in Arabic and English, collect consent where it is required, and keep a simple record of what you process and why. Make withdrawing consent as easy as giving it.
Protect and prepare for incidents
Use HTTPS, two-step admin logins, role-based access and tested backups. Decide in advance who investigates a breach and who must be told, and how quickly.