Oman Outbound Calling Compliance: TRA (2026)

Oman changed its outbound rulebook in August 2026. Until then, marketing calls and bulk SMS were governed only by the general Telecommunications Regulatory Act, the Personal Data Protection Law and licence conditions. Now there is a single instrument that names the hours, the sender ID format, the caller display, the opt-out machinery and the fine for each breach.

At a Glance

Who Regulates Outbound Calling in Oman

The TRA is still a separate authority, founded in 2002 under Royal Decree 30/2002 and describing itself as independent. What changed is governance rather than existence: the Minister of Transport, Communications and Information Technology chairs the TRA Board, and the 2026 regulation is signed in that capacity. The regulation is made under Royal Decree 30/2002 and Decision 144/2008, and binds licensees, TRA-authorised bulk-SMS resellers, local subscribers and advertisers, international subscribers and international aggregators. MTCIT is the separate authority for personal data: PDPL Article 7 makes the Ministry responsible for applying the law through a Competent Department for Personal Data Protection.

There is no TRA telemarketer licence for the end advertiser. Control runs through the operator contract instead. Under Articles 6 and 7 the licensee must take from the local subscriber a declaration of purpose (promotional, service-to-customer, public-interest or value-added), a copy of the commercial registration or equivalent, a declaration that the service will not be used for any other purpose, a declaration of where its sending and receiving systems sit with no relocation without prior operator approval, and the signature of an authorised signatory. Public-interest and awareness messages are reserved to state administrative units and other public legal persons.

Consent and Opt-Out

Oman runs on opt-in, and the burden of proof sits with the sender. PDPL Article 10 permits processing only with the data subject's explicit consent, requires the request to be written, clear, explicit and comprehensible, and obliges the controller to prove the written consent. Article 22 adds a marketing-specific duty: written consent before sending any advertising, marketing or commercial material.

The Executive Regulations set four operational duties before any marketing send. Obtain the written consent. Tell the person the channel the material will arrive on. Specify a mechanism for stopping receipt. Stop sending immediately on a stop request, free of charge. Article 4 adds the conditions for a valid consent: full legal capacity, given clearly and without coercion, in written, electronic or any other form the controller specifies.

Withdrawal is a statutory right under PDPL Article 11(a), and revoked consent is a ground for erasure. No expiry period for a marketing consent appears in either instrument, so treat consent age as a policy decision of your own.

Do-Not-Call

There is no publicly queryable national register that senders check. The 2026 regulation builds carrier-side machinery instead. Article 17 obliges each licensee to provide a clear, TRA-approved mechanism for users to stop promotional calls, promotional messages or value-added services, including the option to block all or some sender IDs and short codes, signposted on the website, in the app and inside the messages themselves. The licensee must execute stop requests and confirm to the user that they have taken effect, log complaints where traffic continues after a stop request, offer a way to re-enable receipt from all senders or a chosen one, and establish a unified database in cooperation with the other licensees to ensure stop requests are executed.

Two consequences matter. The execution and database duties fall on the licensee, not the advertiser, and the regulation prescribes no scrubbing frequency or list-age limit. The advertiser's own duty comes from the data protection side: stop immediately on request, free of charge. Whether the unified database is live, and how advertisers will interface with it, is not stated in the regulation; the six-month transition to about 17 February 2027 is the build window.

Calling Hours and Days

Article 16 permits promotional messages and promotional calls only between 08:00 and 21:00 Oman time. The licensee, the local subscriber and the international subscriber are each bound by it. There is one exception: messages actually sent inside the window whose delivery is delayed by a technical constraint do not breach the rule.

The window applies to promotional traffic only. Service messages, which Article 1(7) defines to include service information, transaction notifications, electronic authentication and one-time passwords, along with public-interest awareness or warning messages, are not brought within it.

There is no weekend, Friday or public-holiday restriction in the regulation. The full text of all six chapters and the Fines Annex was reviewed and contains no day-of-week or holiday carve-out. The rule is expressed as "Oman time", and no primary time-zone citation was obtained, so hold the offset in configuration rather than asserting it as a regulator-sourced fact.

Caller ID and Number Presentation

This is where the regulation is most prescriptive, and where most existing campaigns will need work. Article 15 requires the licensee and the local subscriber to enable caller-name display for promotional, service, value-added or any automated calls, and the displayed name must reflect the trade or legal name. Calls may not be made for any purpose other than the one in the operator contract. Article 14 bans the use of numbers registered to individuals for promotional, service or value-added calls, and requires the operator to suspend service on a report or on detection by its own systems.

For SMS, Article 6(2) requires the sender ID to be the trade or legal name of the sending local subscriber, prohibits generic sender IDs or ones inconsistent with that name, and requires the sender ID used for promotional messages to begin with the prefix "AD". International traffic is tightened separately: under Article 10 the licensee exchanges with the international aggregator a list of permitted sender IDs and blocks any ID not on it. Article 11 flatly prohibits passing SMS bearing a local subscriber's sender ID through an international aggregator.

Two timings belong in a migration plan. Under Article 12(1) licensees must exchange local subscribers' sender IDs on request and activate them within two working days. Under Article 13 a licensee may not block a sender ID from another mobile network without seven working days' notice, reasons and TRA's prior approval, except in proven-harm cases such as impersonation or fraudulent traffic.

Call Recording and Notices

Recording a telephone message without legal basis is a criminal offence. Article 68 bis of the Telecommunications Regulatory Act punishes publishing the content of a communication or telephone message learned by virtue of one's job, or recording it without legal basis, with up to six months' imprisonment and/or a fine up to OMR 2,000, doubled on repetition. Related provisions cover intercepting or altering message contents and unauthorised access to message content or party information.

A call recording is personal data. The PDPL's definition of processing expressly includes recording, so Article 10's explicit and provable consent requirement and Article 21's confidentiality duty both apply. No specific "this call is being recorded" announcement duty, and no contact-centre recording code, appears in the 2026 regulation; its complete text was reviewed. That absence is from that instrument only, so confirm the position with the TRA before relying on it.

Messaging Rules for SMS and WhatsApp

Article 5 allows a local subscriber to obtain bulk SMS only from a licensee or a TRA-authorised reseller. An authorised reseller is a legal person authorised by TRA to sell bulk SMS on behalf of local licensees; the licensee must obtain TRA approval before contracting with one, and final activation of sender IDs and short codes stays exclusively with the licensee. Resellers must host their systems in a licensee data centre or a TRA-authorised data centre at no less than Tier 3 information security, may sell only to local subscribers, and may not pass traffic for any international aggregator or international subscriber.

There is one narrow carve-out: service messages issued by foreign companies licensed to conduct retail activity in Oman, authorised to use their own systems to send them directly, are exempt from the buy-from-a-licensee rule. Short codes are five digits, with codes beginning with 9 for high-value services and 8 for non-high-value services. The regulation does not name WhatsApp or other over-the-top channels; the PDPL duties on written consent, the stop mechanism and immediate cessation are channel-neutral, so treat those as the floor and confirm with the TRA.

Data Protection and Retention

Marketing rests on consent alone. There is no legitimate-interests basis in the Omani PDPL, and the Article 3 contract exemption covers performance of a contract with the data subject rather than promotion to prospects.

Special-category processing needs a permit. Article 5 prohibits processing genetic, biometric, health, racial-origin, sexual-life, political or religious, criminal-conviction or security-measure data without a Ministry permit. The Competent Department decides within 45 days of a complete file, silence counts as refusal, and the permit runs for a maximum of five years.

Cross-border transfer is the highest-risk item in the Omani regime. Article 23 permits transfer under the Regulations' controls and prohibits it where the data was processed in breach of the law or where transfer would harm the data subject. Before transferring, the controller must obtain the data subject's explicit consent, ensure the external party affords protection no lower than Omani law requires, and carry out a transfer risk assessment covering the nature, volume and sensitivity of the data, the purpose and parties, the duration, the countries the data passes through, and the effects on the data subject. MTCIT may demand a copy of that assessment.

Other standing duties: a record of processing activities kept continuously updated, a mandatory data protection officer whose name and contact details are published, an external auditor accredited by MTCIT whose report is filed within 60 days, breach notification within 72 hours, and data-subject requests decided within 45 days free of charge. Retention must have a specific and lawful reason and run for a defined period proportionate to the purpose; no fixed number is prescribed for call recordings or marketing data.

Penalties and Enforcement

The 2026 regulation carries its own Fines Annex, and the fine doubles on repetition, meaning the same violation committed within one year of the earlier fine.

Behind the annex sits the Telecommunications Regulatory Act. Article 51 bis lets TRA suspend a licence for three months, reduce the licensed services or the licence term, collect a fine not exceeding OMR 1,000,000 per violation, impound equipment and revoke the licence. Article 66 makes violating the Act's regulations an offence carrying up to six months and/or a fine up to OMR 5,000, and a legal person is fined twice the prescribed penalty.

On the data side the PDPL provides fines but no imprisonment. Breach of Article 22, the marketing-consent article, carries OMR 1,000 to 5,000. Breach of Article 5 on special categories carries OMR 15,000 to 20,000. Breach of Article 23 on cross-border transfer carries OMR 100,000 to 500,000, by a wide margin the largest exposure in the Omani regime. Legal persons face OMR 5,000 to 100,000, and MTCIT may impose an administrative fine up to OMR 2,000.

What Changed in 2025 and 2026

The headline is the regulation itself. Oman enacted its first dedicated promotional calls and SMS instrument in August 2026: issued 12 August, published in Official Gazette No. 1661 on 16 August, in force 17 August. Addressees must bring themselves into conformity within six months of entry into force, which lands at about 17 February 2027, and anything conflicting with it is repealed.

What becomes newly mandatory inside that window is concrete: the "AD" prefix on promotional SMS sender IDs, caller-name display on promotional, service, value-added and automated calls, the ban on numbers registered to individuals, the 08:00 to 21:00 promotional window, the TRA-approved opt-out mechanism with per-sender blocking and confirmation, and the cross-operator unified opt-out database.

Two smaller items round out the period. TRA published an amendment to the Regulation on the Rights of Users of Telecommunications Services dated 30 August 2026; its contents were not confirmed. On the data side the transition is long past: the one-year conformity period under Ministerial Decision 34/2024 ran from February 2024, so controllers should have been compliant since February 2025.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. Oman does not ship as a jurisdiction pack, so calling hours and do-not-call handling are configured per tenant. The legal responsibility stays with the operator.

Oman Outbound Compliance Checklist

• Sign a contract with a licensed Omani operator before making any promotional or value-added call.
• Buy bulk SMS only from a licensee or a TRA-authorised reseller.
• File the declaration of purpose, commercial registration and system-location declaration with the operator.
• Restrict promotional calls and promotional SMS to 08:00 to 21:00 Oman time.
• Keep service messages and one-time passwords separated from promotional traffic in your campaign design.
• Enable caller-name display showing your trade or legal name on every outbound campaign, automated calls included.
• Remove every number registered to an individual from your outbound pools.
• Prefix promotional SMS sender IDs with "AD" and match the sender ID to your trade or legal name.
• Obtain written consent before any advertising or marketing material and keep it provable.
• Tell the person the channel the material will arrive on and give a stop mechanism.
• Stop sending immediately and free of charge on a stop request.
• Appoint a data protection officer and publish their name and contact details.
• Run a transfer risk assessment and obtain explicit consent before moving Omani personal data offshore.
• Complete the migration before the transition ends at about 17 February 2027.

Sources

1. TRA Oman, Regulation of Promotional and Service Calls and SMS and Value-Added Services, issued 12 August 2026, Official Gazette No. 1661 of 16 August 2026, in force 17 August 2026. TRA legal framework
2. TRA Oman, Laws and Regulations index. TRA laws and regulations
3. Telecommunications Regulatory Act, Royal Decree No. 30/2002 as amended, with Executive Regulations Decision No. 144/2008.
4. Personal Data Protection Law, Royal Decree No. 6/2022, Official Gazette No. 1429, in force February 2023. MTCIT PDPL page
5. Executive Regulations of the Personal Data Protection Law, Ministerial Decision No. 34/2024, issued 4 February 2024, Official Gazette No. 1531. MTCIT Executive Regulations page
6. Royal Decree 90/2020 establishing the Ministry of Transport, Communications and Information Technology.
7. Amendment of certain provisions of the Regulation on the Rights of Users of Telecommunications Services, dated 30 August 2026, on the TRA portal.

Frequently Asked Questions

What are the legal calling hours in Oman?

Article 16 of the 2026 regulation permits promotional messages and promotional calls only between 08:00 and 21:00 Oman time, binding the licensee, the local subscriber and the international subscriber alike. Messages actually sent inside the window but delayed by a technical constraint are excepted. Service messages, including transaction notifications and one-time passwords, are not brought within the window by Article 16.

When do the new Omani rules take full effect?

The regulation was issued on 12 August 2026, published in Official Gazette No. 1661 on 16 August 2026, and came into force on 17 August 2026. Addressees must bring themselves into conformity within six months of entry into force, which lands at about 17 February 2027. That window is the migration deadline for sender IDs, caller-name display and opt-out handling.

Does Oman have a Do Not Call register?

Not a public one that senders query. Article 17 instead requires every licensee to run a TRA-approved stop mechanism with per-sender blocking, execution and confirmation, a complaints route and a re-enable option, and to establish a unified database in cooperation with the other licensees. The execution duty falls on the licensee; the advertiser's duty is to stop immediately on request, free of charge.

What is the "AD" prefix requirement in Oman?

Article 6(2) requires the SMS sender ID to be the trade or legal name of the sending local subscriber, prohibits generic sender IDs and ones inconsistent with that name, and requires the sender ID used for promotional messages to begin with the prefix "AD". A breach falls in the OMR 1,000 to 3,000 band and doubles on repetition within a year.

Must outbound calls show a caller name in Oman?

Yes. Article 15 requires the licensee and the local subscriber to enable caller-name display for promotional, service, value-added or any automated calls, and the name shown must reflect the trade or legal name. Article 14 separately bans numbers registered to individuals for those calls and requires the operator to suspend service on a report or on system detection.

Do I need consent to market to Omani numbers?

Yes, and in written form. PDPL Article 10 allows processing only with explicit consent the controller can prove, and Article 22 requires written consent before sending any advertising, marketing or commercial material. There is no legitimate-interests basis in the Omani law, and the contract exemption covers performance of a contract with the person rather than promotion to prospects.

What are the fines for breaching the Omani rules?

Calling outside the 08:00 to 21:00 window carries OMR 5,000 to 10,000. Breaching the Article 17 opt-out duties carries OMR 5,000 to 15,000. Caller-name and individual-number breaches carry OMR 1,000 to 5,000. Each doubles on repetition within a year. Separately, unconsented marketing under PDPL Article 22 carries OMR 1,000 to 5,000, and a cross-border transfer breach carries OMR 100,000 to 500,000.

Can I record calls to Omani customers?

Only with a legal basis. Article 68 bis of the Telecommunications Regulatory Act punishes recording a telephone message without legal basis with up to six months and/or a fine up to OMR 2,000, doubled on repetition. A recording is also personal data, since the PDPL's definition of processing expressly includes recording, so the explicit consent and confidentiality duties apply to it.

Related Reading

• Oman outbound dialer overview
• Compliance Autopilot
• Caller-ID Pool Control
• MENA outbound compliance guide