WhatsApp Marketing Rules in Oman (2026): PDPL Consent, the New Amendment and the TRA's Promotional-Message Rules

Short answer: under Oman's Personal Data Protection Law (Royal Decree 6/2022), as amended by Royal Decree 68/2026 in force since 7 September 2026, you must have a customer's explicit consent before sending any commercial advertising or marketing, and you must be able to prove it. The law reaches processing of data about people in Oman even when it happens outside the Sultanate, and consent breaches can cost up to OMR 2,000, according to CMS. Separately, the Telecommunications Regulatory Authority's August 2026 regulation limits promotional calls and messages to 8 AM–9 PM Oman time and requires clear sender names and opt-outs. As reported, it is written for licensed operators and telecom traffic such as SMS, so for WhatsApp treat it as best practice. Meta's own rules apply on top: opt-in naming your business, honouring every opt-out, and templates in the right category. This article is a practical guide, not legal advice.

The three rulebooks at a glance

Oman's Personal Data Protection Law

Where it stands in October 2026

The PDPL was issued by Royal Decree 6/2022, and its executive regulations by Ministerial Decision 34/2024. The transition period was extended once and ended on 5 February 2026, when the law became fully enforceable. The regulator is the Ministry of Transport, Communications and Information Technology.

On 3 September 2026 Royal Decree 68/2026 amended the law. It was published in Official Gazette 1664 on 6 September and took effect the next day. Law firm CMS describes it as the first significant amendment since 2022.

What the amendment changed for marketers

• Explicit consent before any marketing. CMS summarises the amended rule as: controllers "must obtain the data subject's explicit consent before sending any commercial advertising or marketing materials." The way consent is obtained will be set by regulation.
• Reach beyond Oman's borders. The amended Article 2 covers processing of data about people in Oman "regardless of whether that processing takes place inside or outside the Sultanate". A Dubai or Riyadh brand messaging Omani customers is in scope.
• No general legitimate-interest route. The amendment adds some grounds for processing without consent, such as employee data for internal purposes, legal obligations and contractual necessity. It does not add a general legitimate-interest basis, so marketing still rests on consent.
• Deletion when the purpose ends. Personal data must be deleted once the purpose it was collected for is fulfilled, unless there is a dispute or a legal duty to keep it.
• Fines. CMS reports fines of up to OMR 2,000 for breaches of the consent article, and up to OMR 10,000 for breaches of processing controls and automated processing.

Obligations that still apply from the original law

From CMS's summary of the law as it entered enforcement:

• Consent must be freely given, unambiguous and verifiable.
• A privacy notice must be clear, accessible and given before you collect data. Arabic is treated as the primary version; other languages are allowed alongside it.
• People can withdraw consent and ask for correction, deletion or a copy of their data. Written requests must be answered within 45 days.
• A data protection officer is required, with public contact details.
• Data breaches that put people's rights at risk must be reported to the regulator within 72 hours.
• Transfers of personal data outside Oman need explicit consent and equivalent protection abroad.

What this means on WhatsApp, in practice

A customer who sends your Salalah hotel a WhatsApp asking about a family room has started a conversation, and you can answer it. That is not consent to receive next year's Khareef offers. For marketing you need a separate, explicit yes, recorded with the date, the source and the wording the customer saw. A pre-ticked box on a checkout page, or a number copied from a delivery app, will not do.

The cleanest proof is a WhatsApp message from the customer themselves. For example, after an order:

تبغى توصلك عروضنا الجديدة على واتساب؟ ردّ بـ «نعم». تقدر توقفها في أي وقت بإرسال STOP.

Would you like to receive our new offers on WhatsApp? Reply YES. You can stop them at any time by sending STOP.

QuickWA records consent on each contact, with its source, and turns STOP replies into opt-outs automatically across broadcasts and journeys. That gives you a record to point to. It does not decide on your behalf whether your consent wording is adequate; that remains your responsibility.

The TRA's promotional-message regulation (August 2026)

In mid-August 2026 the Telecommunications Regulatory Authority issued a regulation on promotional calls, service messages and value-added services, Decision 1511/25/2/36/2026. We could not retrieve the full text, so the points below come from coverage in the Times of Oman, Oman Observer and Muscat Daily.

• Hours: promotional calls and messages only between 8:00 AM and 9:00 PM Oman time.
• Sender identity: businesses must use identifiers that clearly reflect their legal or trade names, and promotional content must be distinguishable from other messages. Calls should show the company's name through caller-name display.
• Opt-out: clear, accessible ways to block or stop promotional calls and messages, and a way to report messages that continue after opting out.
• Operator duties: blocking fraudulent and intrusive traffic, TRA approval before sharing customer data or contracting with international messaging intermediaries.
• Penalties: the Times of Oman reports fines of OMR 500 to OMR 30,000, with higher penalties for repeat violations.

Does it apply to WhatsApp?

As reported, the regulation is aimed at licensed operators and telecom traffic: SMS sender IDs, voice calls and value-added services. WhatsApp messages travel over the internet, not through an operator's SMS gateway, and none of the coverage we read mentions WhatsApp or other internet messaging apps. So treat the TRA rules as a strong best practice for WhatsApp, not as a confirmed legal requirement. They also match what Omani customers now expect from every channel, which is reason enough to follow them.

The simplest way to follow them is to set your sending window in Settings to 8 AM–9 PM Muscat time. In QuickWA, a scheduled broadcast that falls outside the window waits and goes out when it reopens. Your display name already shows your business name, which covers the sender-identity point.

Meta's rules, which apply everywhere

Opt-in

Meta's opt-in guidance says you must clearly tell people they are opting in to messages from your business, and clearly state your business's name. Any method is acceptable if it meets those requirements: a website form, a checkbox at checkout, an SMS, an IVR flow or paper. Meta recommends separate opt-ins for each kind of message.

Opt-out

The WhatsApp Business Messaging Policy says you must respect all requests to block, stop or opt out, whether they reach you on WhatsApp or somewhere else. If a customer tells your Sohar showroom by phone to stop messaging them, that counts.

Template categories

Utility templates must be non-promotional and tied to the customer's own order, booking or account. A delivery update that adds "use code EID20 for 20% off" is classed as marketing. That matters for cost as well as compliance, because a marketing message to a +968 number costs $0.0341 against $0.0247 for utility.

Enforcement

Customers can block or report you. Meta's systems may limit how many messages you can send based on that feedback, and the policy says Meta may limit or remove your access, or ban an organisation from WhatsApp products altogether. Template quality ratings move from high to medium to low on negative feedback and low read rates, and low-rated templates can be paused or disabled. In practice, Meta's quality system is the enforcement most Omani businesses meet first.

A practical compliance checklist

Three common situations in Oman

Numbers from a delivery app or marketplace

Customer numbers you received to fulfil a Talabat or marketplace order were collected for that delivery. Using them for WhatsApp promotions needs that customer's own explicit consent first.

Leads from a Click-to-WhatsApp ad

The customer messaged you, so you can reply to their enquiry. Ask for marketing consent inside that conversation before adding them to campaign lists.

A brand outside Oman selling to Omani customers

The amended Article 2 brings processing of data about people in Oman into scope wherever it happens. A UAE e-commerce store shipping to Muscat should apply the same consent standard as an Omani one.

For setup steps see our Oman setup guide, and for how QuickWA handles consent and sending windows see our Oman page.

Sources

• CMS — Oman updates its Personal Data Protection Law (Royal Decree 68/2026: dates, extraterritorial scope, marketing consent, fines): cms.law (checked 23 Oct 2026)
• CMS — Oman PDPL entering the enforcement phase (Royal Decree 6/2022, Ministerial Decision 34/2024, 5 February 2026, obligations): cms.law (checked 23 Oct 2026)
• Baker McKenzie — Oman strengthening its data protection regime (effective 7 September 2026): bakermckenzie.com (checked 23 Oct 2026)
• TRA regulation on promotional calls and messages: Times of Oman and Oman Observer, 17 Aug 2026 (checked 23 Oct 2026)
• Meta — getting opt-in: developers.facebook.com; WhatsApp Business Messaging Policy: whatsappbusiness.com; template categories: developers.facebook.com; Oman rates: developers.facebook.com (all checked 23 Oct 2026)