- within Employment and HR topic(s)
The new Cybercrime Law, issued by Royal Decree 61/2026, retains an important principle that has existed since the previous Cybercrime Law issued by Royal Decree 12/2011: a legal entity may, in certain circumstances, be held criminally liable for offences committed in its name or for its benefit.
That principle is not new.
What has changed is the scope of the digital risks that may now expose a business to that liability. The 2026 law expands the legal framework governing digital activities, introducing new areas of risk while broadening others. As a result, matters that were previously viewed as operational or IT issues may now have legal implications that deserve the attention of boards and senior management.
When can a company be held liable?
A company may be held liable where a cybercrime is committed in its name or for its benefit by its chairman, a member of the board, its manager or another person acting in a similar capacity. Liability may also arise where the offence occurs with the company's approval, concealment or as a result of gross negligence.
In practical terms, criminal liability may not stop with the individual who committed the offence. Depending on the circumstances, the company itself may also face legal consequences.
What could those consequences be?
In addition to the criminal liability of individuals, a company may be fined up to twice the maximum fine prescribed for the relevant offence.
The court may also order the confiscation of devices, systems or assets used in committing the offence, together with any proceeds derived from it. Depending on the circumstances, it may also order the temporary or permanent closure of the company's information system, website or even the premises where the offence was committed.
For many businesses, however, the commercial consequences may be even more significant. Regulatory investigations, business disruption and reputational damage can have a lasting impact well beyond the financial penalty itself.
Where are the risks most likely to arise?
For most businesses, the greatest risks are unlikely to come from external cyberattacks alone. More often, they arise from routine business activities.
One example is the increasing use of artificial intelligence. The new law expressly recognises AI within its legal framework. Businesses should therefore consider whether employees are uploading customer contracts, confidential documents or sensitive business information to public AI platforms without appropriate internal controls.
Privacy is another area that deserves attention. The law expands protection in this area, making it worthwhile for businesses to review how they use employee location-tracking systems, workplace photographs, CCTV recordings and other personal data collected in the course of business.
The law also places greater emphasis on digital content and misleading information. Managing a company's social media presence is no longer purely a marketing function. Publishing or reposting inaccurate information without appropriate verification may create unnecessary legal exposure.
Another important development is the treatment of digital evidence. Following a cyber incident, data breach or internal investigation, deleting emails, messages or electronic records may not simply be an IT decision. Those records may later become important evidence in legal proceedings.
What should management do?
Preparing for the new law does not require a major compliance programme overnight. However, every business should consider reviewing three practical areas:
- who has access to company systems and sensitive information;
- whether internal policies governing digital communications and social media remain fit for purpose; and
- whether clear rules exist for the use of artificial intelligence and the handling of confidential information.
Conclusion
The key message of Oman's new Cybercrime Law is not that corporate criminal liability is new. It is not. The real change is that the range of digital activities capable of exposing businesses to that liability has become significantly broader.
For businesses, cyber risk should therefore no longer be viewed solely as an IT issue. It is increasingly a governance, compliance and risk management issuethat deserves the attention of senior management and boards alike.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]