Is VPN Legal in Oman? Encryption Licences, WhatsApp Calls and the 2026 Cybercrime Law

No Omani law mentions VPNs by name. The word "VPN" appears nowhere in the Telecommunications Regulatory Act (Royal Decree 30/2002), the 2011 Cybercrime Law or its 2026 replacement. What exists is Article 48 of the telecom act, which requires a ministerial licence for encryption, with no penalty article citing it; a cybercrime code that punishes tools only when held to commit or hide an offence; and a 500 rial fine that comes from a 2010 draft which was never adopted. This is a close reading of the texts, not legal advice.

Article 48 and the encryption licence

Article 48 of the Telecom Regulatory Act says encryption in communications or computer networks is not allowed without a licence from the minister responsible for communications, covering who may operate it, the conditions, the fee and the rules on keeping the encryption key, as set out in the executive regulation. Read Part Seven (Articles 52 to 68 bis 4) and no penalty article refers back to Article 48 by number. The nearest catch-all is Article 66, which punishes breaches of the executive regulation and of decisions issued under the act, with up to six months in prison and/or a fine up to OMR 5,000, doubled on repetition; the original 2002 ceiling was OMR 500 before Royal Decree 64/2007 raised it. Whether Article 66 covers everyday encryption is not settled by the text. Riyadh Al-Balushi, an Omani lawyer, calls the status of VPNs a grey area: every bank login and email is encrypted, so the rule has no practical effect.

The 2026 Cybercrime Law that replaced Royal Decree 12/2011

Royal Decree 61/2026, signed on 1 June 2026 and published in the Official Gazette on 7 June, repealed the 2011 code in full and took effect the day after publication. Neither code mentions VPNs. The MTCIT describes the law as a framework against privacy violations, electronic fraud and misuse of information technology. The provisions that matter are Article 2, extending the law to offences committed wholly or partly outside Oman when the harm reaches Oman or its people; Article 5, punishing intentional access without right to a system or device with one to six months and/or OMR 100 to 1,000; and Article 12, covering devices, programs, passwords or codes held with the intent of committing or facilitating an offence under the law, or hiding its traces, at six months to three years and/or OMR 3,000 to 15,000. SMEX, a Lebanese digital rights group, argues this wording could be used against VPNs and Tor; the article's own text ties the offence to that intent. The remaining articles cover hiding device codes in an offence case, content offences against public order and morals, and let the court confiscate the devices used.

Penalty ceilings in the two laws

A selected sample, not the whole catalogue.

WhatsApp calls and the licensing line

The regulator's position, stated at its April 2025 media briefing, is that it does not ban applications directly but licenses services.

Blocked sites and the July 2026 TRA warning

The US State Department's 2023 country report noted that Oman blocked most VoIP sites. Freedom House scores Oman 24 of 100 and labels it "Not Free" in Freedom in the World 2025, while the 2024 edition notes the government's broad authority to block websites and reported monitoring of personal communications. The TRA's 6 July 2026 warning, covered by Muscat Daily, targets unsafe apps: data harvesting, excess permissions, malware, phishing redirects. Its advice is to use official app stores, check permissions, and avoid free services without a clear privacy policy. It names no penalty. The 2010 draft set RO 500 and RO 1,000 fines and was never adopted.

What companies may do

A company encrypting its own links falls under Article 48, so ask the IT team which licence or approval it relies on. Operators must give security bodies technical access to their networks, while providers may disclose user data only on a court order.

FAQ

Is there a 500 rial fine for using a VPN in Oman?

No. The figure appeared in the 2010 draft regulation only and never became law.

Do WhatsApp calls work without a VPN?

It varies by period and report; the regulator licenses calling services rather than publicly banning them.

Can a visitor be charged just for having a VPN app?

None of the reviewed reports describes a prosecution for VPN use on its own; the documented cases concern online speech.

What this means if you live in or visit Oman

No statute names the technology, the encryption licence lacks its own penalty article, and under the 2026 law a tool becomes an offence only when it is held to commit or conceal a crime. For choosing a service, see the VPNRadarLab Oman page.