- Home
- ChatGPT at work and Oman's data law
Using ChatGPT at work in Oman: what the Personal Data Protection Law means
Many employees already paste emails, contracts and reports into ChatGPT and similar tools to save time. Oman's Personal Data Protection Law (Royal Decree 6/2022) does not ban any particular tool, but it does set rules for what happens to personal data, and a cloud AI service is one more place that data can go.
What the law cares about
The law applies whenever an organisation processes personal data: anything that identifies a person, such as names, ID numbers, phone numbers, salaries or medical details. Putting a document that contains such data into an AI service is processing it. The organisation remains responsible for that data, including when it is handled by an outside provider or sent outside Oman, and the law and its executive regulations set conditions for both. Some categories, such as health and genetic data, are treated as especially sensitive.
Questions to ask before using a cloud AI tool
- What will staff paste in? If the answer includes customer, patient or employee details, the law applies.
- Where is it processed? Most public AI services run on servers outside Oman.
- Is there a contract? A personal account on a free tool is not the same as a business agreement that sets out how data is handled.
- Is it kept or used for training? Check the provider's current terms for the plan you use.
- Can you answer a data subject? People can ask what you hold about them and ask for it to be deleted. That is hard to do if you do not know which tools their data went into.
Practical options
Organisations usually choose one of three paths: write a policy that keeps personal and confidential data out of public AI tools; buy a business plan from a cloud provider and accept processing outside Oman under a contract; or run AI on their own server in Oman, so documents and questions never leave the building. Falaj is built for the third path.
This guide is general information, not legal advice. Your legal adviser can tell you how the law applies to your organisation.
Common questions
Does Oman's Personal Data Protection Law ban ChatGPT?
No. The law does not name or ban any tool. It sets rules for processing personal data, including by outside providers and outside Oman, and the organisation remains responsible for following them.
Is it safe to paste a contract into ChatGPT?
It depends on what the contract contains and on the terms of the plan you use. If it contains personal or confidential information, check where it is processed and whether it is kept, or use a tool that runs inside your organisation.
What is the safest way to use AI on internal documents?
Run it on your own server, so documents and questions stay inside the organisation. Falaj works this way and needs no internet connection.
See it on documents like yours
We bring Falaj to your offices and run it on a sample of your own files, so you can judge the answers yourself.