Cloud Security Muscat English Core — multi-cloud

Data residency

There is no blanket localisation mandate, but transferring personal data outside Oman generally requires the data subject's consent and must not prejudice national security or the country's higher interests; the controller must ensure the overseas processor offers protection no lower than the PDPL. Penalties for unlawful cross-border transfer reach OMR 500,000.

What shapes cloud procurement here

Government and energy-sector tenders carry In-Country Value requirements, so bidders are typically scored on local registration, local hiring and Omani supply-chain spend rather than price and technical fit alone. No hyperscaler operates a public multi-tenant region in Oman, so buyers choose between domestic data centres and UAE or Bahrain regions, with AWS Direct Connect available at Equinix MC1 (Barka, Muscat), homed to the AWS Middle East (Bahrain) region. The PDPL transition period ended in February 2026, so consent records and cross-border transfer documentation are now an active part of vendor evaluation. Arabic is required for government contracting while technical delivery and documentation are normally in English, and the local senior cloud and DevOps talent pool is small, which makes buyers attentive to knowledge transfer and local support coverage.

Sector regulators