Guide · Oman
Outsourcing web development to India from Oman
You can work remotely with a web development team in India, but plan for Oman's rules on personal data transfers, imported services and withholding tax. India's export rules also affect invoices and payment. India is 1h30m ahead of Oman, so agree on call times around the working week. Before sharing personal data, check consent, protection and transfer risks. Discuss how the team will handle the project, payment and disputes before work begins.
Checked against official sources on 5 November 2026. General information, not legal advice: confirm the rules that apply to your business with an adviser.
When can you work with a team in India?
Oman's working week is Sunday–Thursday, and IST is 1h30m ahead. Agree call times with your Indian team around those hours.
Sohail, MSH Technologies' founder, replies to every enquiry within 1 working day, Monday to Saturday in India time.
Can you send personal data to a team in India?
Oman's Personal Data Protection Law applies to processing personal data of natural persons in Oman, whether the processing takes place inside or outside Oman.
Article 23 allows a controller to transfer personal data outside Oman under the controls and procedures in the Executive Regulation. A transfer is prohibited if the data was processed in breach of the law or the transfer would harm the data subject.
Before a transfer, the controller must obtain the data subject's explicit consent unless an exception applies, such as an international obligation or anonymised data. The controller must also assess the protection level and transfer risks, and ensure the foreign processing party offers protection no lower than Omani law.
India's cross-border and exemption provisions in sections 16 and 17 of the Digital Personal Data Protection Act, 2023, come into force on 13 May 2027. Under section 17(1)(d), when a person based in India processes personal data of individuals outside India under a contract with a person outside India, most Data Fiduciary obligations, Chapter III rights and the section 16 transfer rule do not apply. Sections 8(1) and 8(5), covering responsibility for compliance and reasonable security safeguards against personal data breaches, still apply.
What tax and invoicing rules apply?
When a VAT-registered business in Oman receives services from a non-resident supplier and the place of supply is in Oman, it accounts for VAT under the reverse charge mechanism. It reports output VAT and can deduct the corresponding input VAT if the normal criteria are met.
Oman applies a 10% withholding tax to certain income generated in Oman by a foreign person without a permanent establishment there. The listed income includes royalties, consideration for the use of computer software, management fees and the performance of services.
Under India's IGST Act, 2017, an export of services is a zero-rated supply. A service qualifies as an export only when the supplier is in India, the recipient and place of supply are outside India, payment is received in convertible foreign exchange or Indian rupees wherever permitted by the Reserve Bank of India, and the parties are not merely establishments of a distinct person.
An Indian export-of-services invoice must carry the applicable export endorsement. It must also give the recipient's name and address, the address of delivery and the name of the country of destination.
Under Oman's Fawtara e-invoicing programme, taxpayers whose supplies exceed OMR 5,000,000 in April 2026–March 2027, or are expected to in April 2027–March 2028, must implement e-invoicing from 1 April 2027. Other taxpayers must implement it from 1 October 2027.
How should you arrange payment to an Indian supplier?
Agree payment arrangements with the supplier. Under India's Foreign Exchange Management (Export and Import of Goods and Services) Regulations, 2026, an Indian exporter must realise and repatriate the full value of exported services within nine months from the invoice date, or twelve months if the export is invoiced or settled in Indian rupees. Its Authorised Dealer bank may allow more time on request.
An Authorised Dealer bank may permit a third party to pay for an export if it is satisfied that the transaction is bona fide. Check with the supplier before arranging third-party payment.
What should the contract say about disputes?
Check the dispute terms with your supplier. India applies the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards only to awards made in another contracting State and to differences considered commercial under its national law.
What should you check before outsourcing to India?
Plan for your users as well as your supplier. Arabic is Oman's official language; English is widely spoken as the language of business and higher education, though less so outside Muscat.
- Agree call times around the working week and time difference.
- Assess consent, protection and risks before transferring personal data.
- Check how reverse charge VAT and withholding tax apply to your purchase.
- Confirm the invoice details with the supplier.
- Agree payment arrangements, including any third-party payment.
- Check the contract's dispute terms.
- Agree how design, development and launch will be handled remotely.
- Decide which languages your users need.
Questions
When must an Oman business register for VAT?
Registration is mandatory when supplies exceed or are expected to exceed OMR 38,500 a year. Voluntary registration is possible above OMR 19,250.
Do imported services count towards the VAT registration threshold?
Yes. Oman's Tax Authority says a business that is not VAT-registered must include the value of services it receives under the reverse charge mechanism when working out whether it has reached the threshold.
What happens if a personal data breach poses a risk to people?
Organisations in Oman must notify MTCIT within 72 hours of a personal data breach that may pose a risk to data subjects' rights.
Do you need consent to send marketing material?
Yes. Article 22 of Oman's Personal Data Protection Law requires a data controller to obtain the data subject's written consent before sending them any advertising or marketing material.
Can your project process health or biometric data?
Processing sensitive personal data such as health or biometric data requires a permit from MTCIT under Article 5 of Oman's Personal Data Protection Law.