Monday, July 15, 2019

What are the Likely Consequences of GDPR for Companies in Oman?

The EU’s General Data Protection Regulation (“GDPR”) replaces the Data Protection Directive 95/46/EC and is designed to safeguard people’s personal information by harmonising data privacy laws across the EU.

As of 25 May 2018, individuals now have the right to demand that a company reveals or deletes personal data that the company holds about them.  Regulators now have powers to enforce their decisions with penalties.

The GDPR also addresses the export of personal data outside the EU.  Even entities operating beyond the EU, such as those in Oman, could be affected.

The GDPR applies to personal data, including names, addresses, emails, etc. and also IP addresses.  Most companies of whatever description are likely to have databases of personal information relating to clients, employees, and suppliers - all of which information will potentially be covered by the GDPR.

The GDPR would apply to a company operating in Oman if the company:

(a) has a branch, subsidiary or any representative in the EU;

(b) offers any goods or services to persons located in the EU; and/or

(c) monitors the online behaviour of persons located in the EU.

The GDPR sets out how companies must deal with the data they collect.  Breaches of data confidentiality must be disclosed within 72 hours of discovery of the breach.  Sensitive data cannot be used by organisations when deciding on a course of action.  Sending out mass marketing emails to people that have not actively subscribed to receive them is also not permitted.

An organisation that violates the rules could face fines of up to 4% of their global annual revenue or €20 million (approximately OMR 8.77 million), whichever is greater.

Companies that may fall within the ambit of the GDPR should review their policies in relation to:

(a) protecting and managing personal data;

(b) reporting breach incidents within 72 hours; and

(c) determining who will take the lead role in data protection and privacy - the executive
management, the board, the chief information security officer or a data protection officer.

Companies that might be affected should:

(a) establish transparent and easily accessible privacy and data protection policies and procedures;

(b) review and update all existing contracts with data processors and customers to provide for more stringent data protection and consent clauses;

(c) create a framework for accountability by monitoring, reviewing and assessing data processing activities;

(d) evaluate insurance policies to ensure the company is adequately protected in the event of a data breach;

(e) conduct internal training sessions to ensure employee compliance with the new data protection obligations; and

(f) consider whether the employment of a data protection officer is required.

It will be important for businesses in Oman to assess all personal data processing activities.  This should include an audit of any activities likely to involve the processing of personal data relating to individuals in the EU, including information that indirectly identifies such individuals (such as IP addresses or customer reference numbers).


Read More...



Monday, July 8, 2019

Establishment of Companies by Sultani Decree

Typically, commercial companies in Oman are incorporated in accordance with, and governed by, the provisions of Sultani Decree 18/2019, promulgating the Commercial Companies Law (the “CCL”).

However, under the provisions of Sultani Decree 33/1974 concerning Companies Established by Sultani Decree, companies may be established by a Sultani Decree.  Establishing a company by Sultani Decree is most often required when a company is established by a governmental body to acquire public or exclusive functions.  These functions typically relate to a specific activity or economic/business sector and, up to the establishment of the company, form part of the competences of a ministry or other government entity.  Usually, a simultaneous and separate Sultani Decree is issued amending the list of competences of such ministry or public authority by deleting the matters delegated to the new company.  An outline of the main provisions in respect of the establishment of a company by Sultani Decree is set out below:


  • The entity proposing the establishment of the company must submit to His Majesty a written statement setting out the reasons preventing the new company’s incorporation in accordance with the CCL.
  • His Majesty shall then rule as to whether such reasons are sufficient for the situation to be considered exceptional.
  • If the company is set up and no explanatory statement has been submitted; or such statement contains material misrepresentations; or such statement omits material facts whose inclusion is necessary to prevent the statement from being misleading, the company shall be deemed void ab initio.  Any persons conducting activities in the name of the company shall be considered personally liable for the obligations arising out of such activities.
  • The new company must take one of the forms of company provided for in the CCL.  However, in practice, a company formed by Sultani Decree tends to take the form of a closed joint stock company.
  • The new company’s constitutive documents or regulations, its governing rules, and its activities must comply with the provisions of the CCL within one year of the issuance of the Sultani Decree establishing the company.
  • Failure to comply with the above shall render the new company void at the end of this period.  Any persons conducting activities in the name of the company thereafter shall be personally liable for the obligations arising out of such activities.
  • The new company must comply with the Commercial Registration Law.
  • The company must be managed in accordance with the provisions of the CCL.  Traditionally, government-owned companies formed by Sultani Decree have employed at the outset governmental staff drawn from the promoting ministry or government unit.  This is usually provided for in the relevant Sultani Decree.

Notable examples of government-owned companies established by Sultani Decree include Oman Post, Oman Fisheries, Oman Oil and Oman Aviation Services.

Read More...



Monday, July 1, 2019

In the Pipeline

Oman is to take measures in line with standards set by the European Union (“EU”) and the Organisation for Economic Co-operation and Development in order to tackle tax evasion.  It is currently drafting regulations governing the automatic exchange of information through Common Reporting Standards (“CRS”).  CRS is a global version of the Foreign Account Tax Compliance Act, which was introduced by the U.S. Congress to prevent offshore tax abuse.  The measures should pave the way for Oman’s removal from the EU tax blacklist, to which it was added in March 2019.

A new Bankruptcy and Insolvency Law is currently under consideration at the State Council.  The law is part of a suite of new statutes planned by the Government to boost investment in the Sultanate and improve the Sultanate’s ranking in the World Bank’s ‘Ease of Doing Business’ Index.  The proposed statute will set out the rights and responsibilities of an insolvent company’s creditors and the sequence of the settlement process to be followed.  It will also define the roles of the various parties involved in the process.  The law is expected to be enacted later in 2019.

Please contact us if you would like more detailed advice on the above.


Read More...