Why Visitor Data Is Harder Than Employee Data Under the PDPL

Oman's Personal Data Protection Law, issued by Royal Decree 6/2022 and fully enforceable since February 2026, applies to a name written at a reception desk exactly as it applies to a payroll record. What differs is the ground you are standing on when you process it.

The asymmetry, side by side

Read down the right-hand column and the shape of the problem appears. Every structural convenience you have with employees is absent, and the last row is where most organisations are quietly non-compliant: there is no statutory reason to keep a visitor record for seven years, and no process that deletes it either.

The consent trap at the door

Leaning on consent for visitor data creates the same problem it creates for employees, for a different reason. A visitor asked to consent at a turnstile, with a host waiting and a meeting starting, is not making a considered decision. And consent is withdrawable — so a visitor may later ask you to delete the record of a visit that your security obligations require you to retain.

The more defensible position is to separate the two purposes clearly. The security record of who was on site is not there because the visitor agreed to it; it exists because a building has to know who is inside it, and that purpose stands on its own. Marketing follow-up, adding someone to a mailing list, or keeping their details for future convenience are entirely different purposes, and those genuinely do need consent that can be declined without consequence.

Conflating them is the common error: one tick box covering both, which means the security record inherits the revocability of the marketing permission.

A notice nobody will read, in the language they use

The PDPL expects clear information about processing. At a reception desk you have a few seconds and a small screen, and a visitor who is already late. A five-screen policy scrolled past is compliance theatre; it satisfies nobody and demonstrates nothing.

What works is short and layered: one sentence on why the record exists and how long it is kept, in Arabic or English at the visitor's choice, with the full notice one tap away for anyone who wants it. The language point is not decoration. A notice presented only in English to a visitor who reads Arabic has not informed them, whatever it says.

What you are not collecting is an advantage

It is worth noticing which design choices reduce your obligations rather than manage them. Verifying a visitor by one-time code to their own phone establishes that the contact detail is real while holding only a phone number. Capturing a facial image or fingerprint instead would establish identity more strongly — and would move the whole system into the biometric category, which under Article 5 of the PDPL is prohibited without a Ministry permit, as biometric attendance systems have to deal with.

For a reception desk that is a poor trade, and avoiding it is a deliberate design decision rather than a limitation. The same logic applies to photographing ID documents: it feels rigorous, and it means you now hold a copy of a passport for every visitor, with a retention question and a breach exposure attached to each one.