1. Employee data is now clearly subject to the PDPL
Prior to the amendments, Article 3 of the PDPL provided that the law did not apply to personal data processing carried out in performance of a contract to which the data subject was a party. In the employment context, employers could therefore reasonably argue that much of the personal data processing required to manage the employment relationship fell outside the scope of the PDPL altogether. The removal of that exemption means that this position is no longer available and employee data processing will now generally be subject to the PDPL unless another exemption applies.
As a result, employers should no longer assume that ordinary employment-related processing sits outside the privacy regime. Personal data protection policies, employee privacy notices, consent mechanisms, governance procedures and related employment documentation should now be reviewed against the requirements of the amended PDPL.
2. Employers may not always need employee consent
While the removal of the Article 3 exemption expands the scope of the PDPL in the employment context, the amendments also recognise the practical realities of the employment relationship, and provide employers with greater flexibility in how they approach certain employee data processing activities. Employers may now be able to rely on specific statutory exceptions instead of obtaining employee consent for certain routine employment-related processing activities.
Most significantly, personal data may be processed without obtaining employee consent where the processing is necessary for the performance of a contract to which the employee is a party, provided that the contract includes a statement confirming that personal data will be processed in accordance with the PDPL. Similar carve-outs apply where processing is necessary to comply with a legal obligation.
This is a timely opportunity for employers to review employment contracts, offer letters and other employment documentation in light of the new exemption. However, the amendments should not be viewed as removing the need for employee consent altogether. The exemption is limited in scope and will not necessarily apply to every processing activity undertaken in the employment context. Employers should therefore take stock of how employee personal data is collected, used and shared across the business, and consider whether any updates are required to their privacy notices, consent processes, employment documentation or their broader internal data protection framework.
3. Employers can now process sensitive employee data more easily
One of the most significant practical changes for employers concerns the processing of sensitive personal data. Under the original PDPL, the processing of certain categories of sensitive personal data, including health data, biometric data and ethnic origin data, required a permit from the Ministry of Transport, Communications and Information Technology (Ministry) before the processing could be carried out.
The amendments introduce an important employment-related exemption. Employers will generally be able to process sensitive employee data for routine HR and workforce management purposes without first obtaining a Ministry permit, provided certain conditions are satisfied.
This is likely to be particularly relevant to employers that routinely process employee health information for medical insurance and employee benefits purposes, maintain sickness absence and occupational health records, or use biometric systems, such as fingerprint or facial recognition technology, to control access to workplaces and facilities.
However, employers should not assume that the permit requirement has been removed entirely. The exemption is subject to a number of conditions and limitations, including restrictions relating to disclosures of employee data to third parties. Businesses that routinely share employee personal data with insurers, service providers, contractors or group companies should therefore review their existing arrangements carefully to ensure they remain compliant with the amended PDPL.
Key actions for employers
To comply with the amended PDPL, employers should review their existing employee data protection arrangements and identify any areas requiring update.
In particular, employers should assess:
- whether they have a compliant personal data protection policy in place;
- whether employee privacy notices, consent procedures and onboarding documentation need to be updated;
- whether employment contracts, offer letters and other employment documentation should be amended to reflect the amended PDPL;
- whether sensitive employee data, including health and biometric data, is being processed in accordance with the amended PDPL; and
- whether employee data is being shared with group companies, insurers, service providers or other third parties on a compliant basis.
While the amendments to the PDPL remove certain administrative burdens for employers, they also make it clear that employee personal data processing will generally be subject to the PDPL. Employers should therefore ensure that their policies, employment documentation, privacy notices and HR practices are aligned with the amended PDPL. Organisations that rely on global privacy frameworks or standard group-wide documentation should also consider whether any Oman-specific measures are required.
