MUSCAT – The new Cybercrime Law was issued under Royal Decree No. 61/2026 by His Majesty Sultan Haitham bin Tarik and replaces the previous Cybercrime Law promulgated under Royal Decree No. 12/2011. The law comes into force the day after its publication in the Official Gazette.

Among the most significant provisions, unauthorised access to websites, information systems, or digital platforms can result in imprisonment ranging from one month to six months and fines of up to RO 1,000. Penalties increase substantially if the intrusion results in data alteration, destruction, disclosure, encryption, or harm to users, with prison terms extending to three years when personal data is involved.

The law imposes stricter punishment for attacks targeting government databases and systems. Unauthorized access to government electronic information carries prison terms of one to three years, while altering, destroying, publishing, or encrypting government data can lead to imprisonment of three to seven years and fines of up to RO 10,000. The same protections apply to data belonging to banks and financial institutions.

Public officials who commit cyber offenses in connection with their duties face enhanced penalties. In severe cases involving government information, imprisonment may reach 10 years alongside fines of up to RO 15,000.

The Law also criminalises the possession, production, import, export, sale, or distribution of software, devices, passwords, or tools intended to facilitate cybercrime. Offenders face prison terms of six months to three years and fines ranging from RO 3,000 to RO 15,000.

The law penalises individuals who refuse to provide access credentials or tamper with digital evidence. Concealing passwords or refusing to provide them to judicial authorities may result in imprisonment of up to one year, while tampering with digital evidence carries prison terms of up to three years.

It introduces penalties for cyber fraud, identity theft, and electronic forgery. Online impersonation is punishable by up to one year in prison, while obtaining unlawful benefits through digital fraud can result in imprisonment of up to three years and fines reaching RO 5,000. Penalties are doubled when victims are minors or persons with diminished legal capacity.

Several provisions target online content and activities affecting public order and national interests. Publishing or broadcasting rumours, misleading information, or content deemed harmful to public order or morals can lead to prison terms of up to three years and fines of up to RO 3,000. If the intent is found to be inciting sedition, hatred, racism, sectarianism, discord, or harm to individuals, penalties increase dramatically to between three- and 10-years’ imprisonment and fines of up to RO 10,000.

The law also criminalises the online publication of false news, statements, or rumours intended to damage the reputation of the state, undermine confidence in financial markets, or affect national security, social stability, or public health. Violators face prison terms of three months to three years and fines ranging from RO 2,000 to RO 5,000.

Under the new framework, using digital platforms to organize or incite unauthorised gatherings, strikes, sit-ins, or marches may result in prison terms of up to one year and fines of up to RO 3,000.

The legislation further addresses online trafficking in weapons, ammunition, explosives, antiquities, meteorites, and works of art. The most serious offenses involving prohibited weapons can carry prison sentences of up to 15 years and fines reaching RO 100,000.

Additional provisions criminalise the online publication of military or security-related information that could harm official operations, insulting national symbols, undermining the judiciary, and actions that could negatively affect Oman’s foreign relations.

The law also expands its scope to cover emerging technologies, introducing legal definitions for artificial intelligence, artificial intelligence systems, social media platforms, digital evidence, and electronic payment methods.