Oman's data protection regime is built from two instruments: the Personal Data Protection Law, issued under Royal Decree No. 6/2022 on 9 February 2022, and its Executive Regulations, issued under Ministerial Decision No. 34/2024 on 4 February 2024. The Regulations are where the operative detail sits — consent validity, permit procedure, transfer conditions, notification periods.

Anyone arriving from a GDPR background will make two mistakes if these are not stated plainly.

1. There is effectively one lawful basis, not six. The PDPL rests on the data subject's explicit consent. It does not offer legitimate interests, and it does not offer a general contractual-necessity basis in the way European law does. Instead it lists situations in which the law does not apply at all — Article 3. The analysis is therefore about whether an exemption applies, not which basis to select. Section 03.
2. Consent alone can support a cross-border transfer. There is no adequacy list to work through and no standard contractual clauses regime to execute. The condition is consent, plus the overriding limits on national security and harm to the data subject. Section 09.

Getting the role wrong is the most consequential error available in a data protection policy, because every obligation in the law attaches to a role. Prima occupies three different positions depending on the data, and the third is the one that matters commercially.

Most infrastructure providers claim to be a mere processor of customer data. Prima's position is stronger and different: on bare-metal GPU capacity there is no processing relationship at all. The customer receives dedicated hardware, administers its own operating systems, and holds its own credentials. Prima's staff have no logical route into a customer's allocation — not a restricted route, not a logged route, none.

This is verifiable architecturally rather than by assurance, which is what makes it worth stating. An auditor or a customer's counsel can test the claim by examining the access model rather than accepting a representation. The consequence is that a compromise of Prima cannot expose customer workload data, because Prima does not have it.

The PDPL rests on the explicit consent of the data subject. It does not provide the menu of alternative bases familiar from European law. What it provides instead is Article 3 — a list of circumstances in which the law does not apply to the processing at all. The analysis for each activity is therefore a two-step one, and doing it in the wrong order produces consent requests that are unnecessary and, worse, misleading.

1. Does an Article 3 exemption cover this processing? The exemptions include performance of a legal obligation imposed on the controller by law, judgment or court decision; protection of national security or public interest; and data already available in open sources. Where an exemption applies, the processing proceeds on that footing.
2. If not, is there valid explicit consent? Consent must come from a person of full capacity, be given clearly and without coercion, and be recorded in writing or electronically — Executive Regulations, Article 4. If neither step is satisfied, the processing does not happen.

Three rules follow, and they are stated because the failure mode is always the same — a consent form used to legitimise processing the subject cannot realistically refuse.

• Consent must be refusable. If refusing would cost the person their job, their site access or their contract, consent is not the right basis and an exemption analysis must be done instead.
• Consent is specific. One consent does not cover a second purpose. A visitor consenting to identity verification has not consented to their image being used for anything beyond site security.
• Consent is withdrawable, and withdrawal has consequences that are explained in advance. A contractor who withdraws consent to biometric enrolment cannot be given unescorted access — that is a legitimate operational consequence, and it is disclosed at the point of enrolment rather than discovered afterwards.

Stated so that a reviewer does not have to look for it. Prima does not sell or share personal data for commercial purposes; does not send marketing without separate written consent, which the PDPL requires expressly; does not use personal data for automated decisions about individuals; does not process children's data; and does not use CCTV or access records for performance management of staff.

Article 17 requires documentation of processing operations. This and the following section are that record. Retention periods are the maximum held; data is deleted earlier where the purpose has ended.

Article 5 of the PDPL prohibits the processing of sensitive personal data unless a permit has been obtained from MTCIT. This is a prohibition, not a condition — the processing is unlawful until the permit exists. It is the strongest single requirement in the law and the one that has direct consequences for Prima's security design.

Article 5 names data relating to genetic and biometric characteristics, health, ethnic origin, sexual life, political or religious opinions and beliefs, criminal convictions, and related security measures.

1. Template, not image. The reader stores a mathematical template from which the original biometric cannot be reconstructed. No fingerprint or hand image is retained anywhere in the estate.
2. Held on the access platform only. Never copied into HR systems, never exported, never included in a report. The template exists in one place and is reachable only by the access-platform administrators named in PRM-SEC-2026-001.
3. Consent in addition to the permit. The permit makes the processing lawful in principle; the individual's explicit written consent is still taken at enrolment, with the consequence of refusal explained in advance.
4. Destroyed at departure. The template is deleted when the person leaves or their entitlement is withdrawn, verified at the next access recertification cycle rather than left to the leaver process alone.
5. Never used for anything but authentication. Not for timekeeping, not for attendance, not for productivity. Any such reuse would be a new purpose requiring a new basis and a new permit.

Stated concretely, because a policy that identifies a blocking dependency without an alternative has only described the problem.

Occupational health records also fall within Article 5. Prima's position is to minimise rather than permit: line management receives a fitness-for-role outcome only — fit, fit with adjustment, or not fit — and never the underlying medical information, which is held by the occupational health provider. Injury records required by statutory reporting are handled under the Article 3 exemption for legal obligations. Where any processing beyond this becomes necessary, it requires its own permit and is not undertaken until one is held.

The PDPL grants six rights. The response period is 45 days — longer than the thirty days of comparable regimes, which makes missing it harder to excuse rather than easier.

1. Any route counts. A request to any Prima address, to any employee, verbally or in writing, is a valid request. There is no prescribed form and requiring one would be unlawful. Anyone receiving one forwards it to the DPO the same day.
2. Identity verified proportionately. Enough to be confident, not enough to become a barrier. Requesting a document the subject does not have is a refusal dressed as a process.
3. Logged on receipt, with the date the 45-day period expires calculated and visible from that moment. The DPO holds the register.
4. Answered in full or refused with reasons. A partial answer that does not say what was withheld and why is treated as a failure to respond.
5. Free of charge. No fee for a first request.
6. Escalated at day 30 if not resolved, to the CISO and then the COO. Waiting until day 44 to discover a problem is the predictable failure and the escalation exists to prevent it.

Article 14 requires the controller to notify the data subject in writing, before processing begins. A notice published after collection has started does not cure the collection, and a notice that exists only on a website does not reach someone walking through a gate.

• Who the controller is — Prima Artificial Intelligence LLC, CR 1575008, with the DPO contact route.
• What data is collected, specifically. “Personal information” is not a category.
• Why, and on what basis — consent, or the Article 3 exemption relied upon.
• Who it is shared with, including whether it leaves Oman and to where.
• How long it is kept.
• The rights available, how to exercise them, and the right to complain to MTCIT.
• The consequence of refusing, where consent is the basis.

Consent is worthless without proof of it. Every consent is recorded with who consented, to what, when, and by what means — the wording shown to them at the time, retained so that it can be produced later. A tick recorded without the text it referred to cannot be evidenced and is treated as no consent at all.

Article 23 permits transfer outside the Sultanate under conditions set by the Executive Regulations. Article 37 of the Regulations makes the data subject's consent sufficient, without prior approval from MTCIT, provided the transfer does not prejudice national security or the higher interests of the State. Two absolute prohibitions sit alongside: data may not be transferred if it was processed in breach of the law, or if the transfer would cause harm to the data subject.

There is no adequacy list to work through and no standard contractual clauses regime to execute. The obligation is simpler and, in one respect, stricter: consent must be informed as to destination. A consent that does not tell the person where their data is going is not consent to the transfer.

• Biometric templates. Held only on the on-site access platform. Never exported, never replicated to a cloud service, never included in a backup that leaves Oman.
• Video recordings. Retained on site. Released only under the lawful-request procedure in PRM-SEC-2026-001 §11, and a request from a foreign authority is handled through the Omani legal route rather than answered directly.
• Access logs and investigation files. On site, for the same reasons.
• Occupational health records. Held by the provider within Oman.

Article 19 requires the controller to notify both MTCIT and the affected data subject of a breach leading to destruction, alteration, unlawful disclosure of, access to, or processing of personal data. Qualifying breaches are notified within 72 hours. Failure carries a fine of not less than OMR 15,000 and not more than OMR 20,000.

Many regimes require notification to the regulator and leave notification to individuals to a harm test. The PDPL names both. Prima therefore plans for both notifications from the first hour, rather than deciding later whether individuals need to be told.

The PDPL requires appropriate measures without prescribing them. Prima's are the ones already documented elsewhere, applied to personal data specifically — this policy adds no new control set, which is deliberate: a second, parallel security regime for personal data would be maintained worse than the first.

Retention periods are in the processing record at sections 04 and 05. Two rules govern how they are applied.

• Deletion is scheduled, not incidental. A quarterly review identifies records past retention and deletes them. Data that outlives its purpose because nobody looked is the most common breach of this law, and the least dramatic.
• Legal hold overrides retention. Where a dispute, investigation or regulatory request is live, the affected records are held until it closes — recorded as a hold with a reason and an owner, not left as an unexplained exception.

The PDPL contemplates evaluation of the controller's data protection arrangements by an auditor approved by MTCIT. Prima will appoint one once the policy set is in force and the processing record is populated — sequenced after the ISO 27001 stage 1 audit in November 2026, so that the same evidence base serves both and the two reviews do not contradict each other.

Stated because a policy that omits the consequence reads as advisory. The PDPL carries banded penalties, and the Ministry may separately impose administrative measures — warnings, suspension or cancellation of a processing permit, and administrative fines of up to OMR 2,000 per violation.

• Exposure is narrow by design. Prima holds no customer workload data and is neither controller nor processor of it. The personal data it holds is its own — personnel, contractors, visitors, video, access records, commercial contacts.
• Two categories are sensitive under Article 5 — biometric and health. The biometric permit is the one blocking item, and the security design needs a documented fallback rather than an assumption that it will be granted.
• One item is non-compliant today: personal data is being collected on primacompute.com without a privacy notice, and the law has been fully enforceable since 5 February 2026. It is fixable this week.
• Everything else is drafting and installation — notices, consent wording, a rights register, and physical signage. All internal, none waiting on the facility.