Data breach response
This page explains what we do if personal data is lost, exposed, or accessed without permission, and how you can tell us about a problem.
Draft, pending legal review
This document is an in-house draft, prepared for review by legal counsel in Oman. It is not legal advice, is not yet in force, and may change.
How to report a concern
If you believe your data has been exposed, or you see something that looks wrong, tell us through our complaints channel. We treat a suspected breach as urgent.
The steps we take
- Contain: we stop the exposure and secure the affected systems.
- Assess: we work out what data was involved, whose data it was, and the likely impact.
- Notify: we tell the people affected and the regulator within the time the law requires, and, for a clinic's patient data, we tell the clinic.
- Remediate: we fix the cause and take steps to stop it happening again.
- Record: we keep a record of what happened and what we did.
What you can expect
If a breach is likely to affect you, we tell you what happened, what data was involved, what we are doing, and what you can do to protect yourself. We do not hide a breach that affects you.
This document is published in Arabic and English. If the two versions ever differ, the Arabic version is the one that applies.