Cybersecurity law & regulation in Iran (2026)
Cybersecurity in Iran: sectoral rules.
Iran's cybersecurity regime is built around the 2009 Computer Crimes Law, which criminalises unauthorised access, data interference, and system disruption, enforced by the dedicated Cyber Police (FETA). The Supreme Council of Cyberspace, established in 2012, serves as the apex policy body coordinating all state agencies on cyberspace matters, including the development of Iran's domestic National Information Network. There is no comprehensive horizontal cybersecurity or data-breach-notification law comparable to the EU NIS2 Directive; proposals to expand internet and cyber control legislation have repeatedly stalled or been withdrawn under public pressure.
Legal framework
Computer Crimes Law (Law No. 71063, 2009); Supreme Council of Cyberspace (est. 2012 by Supreme Leader decree); FETA (Cyber Police of the Islamic Republic of Iran)
Key points: cybersecurity in Iran
Computer Crimes Law (2009)
Law No. 71063, enacted by Parliament in January 2009 and effective June 2009, comprises 55 articles added to Book Five (Ta'zirat) of the Islamic Penal Code. It criminalises unauthorised access, unlawful interception, data destruction, fraud, and distribution of illicit content via computer or telecommunications systems, with penalties ranging from fines to imprisonment.
Supreme Council of Cyberspace
Established on 26 February 2012 by decree of Supreme Leader Khamenei, the SCC is the centralised policymaking, decision-making, and coordination body for all cyberspace matters. All state agencies, including Parliament, are required to comply with its decisions. It oversees the National Information Network (Iran's sovereign intranet) and content governance.
FETA (Cyber Police) enforcement
No breach-notification or incident-reporting regime
Iran has no statutory data-breach notification obligation or formal cyber-incident reporting framework comparable to the EU NIS2 or GDPR regimes. A Draft Protection of Personal Data Law announced by the Ministry of ICT in 2018 remains unratified by Parliament as of 2025-2026.
Proposed internet-control legislation (2025, withdrawn)
In July 2025, the Pezeshkian administration submitted an urgency bill, 'Combating the Dissemination of False Content in Cyberspace', to Parliament. It was withdrawn after significant public backlash. A separate 'Protection Bill' granting IRIB (state broadcaster) sweeping control over audio-visual online content has also been revived and debated, signalling ongoing legislative attempts to tighten cyber control.
Iran-Russia information-security cooperation (2023)
In December 2023 Iran's Parliament approved a bilateral information-security cooperation agreement with Russia, signalling an intent to deepen defensive and offensive cyber coordination with Moscow outside of any domestic comprehensive cybersecurity law framework.
Timeline of decisions
- DecisionSupreme Council of Cyberspace Silently Enacts Three Articles of Unratified Protection Bill
Without parliamentary approval, the Supreme Council of Cyberspace issued a directive implementing three articles of the Cyberspace User Protection Bill, consolidating armed-forces control over Iran's internet gateways and enabling tiered bandwidth throttling. The move created a de facto regulatory regime bypassing the legislature entirely.
ARTICLE 19
- LawParliament Fast-Tracks Internet User Protection (Siyanat) Bill Under Article 85
The Iranian parliament voted to advance the Cyberspace User Protection Bill under Article 85, granting a Supreme Regulatory Commission authority to manage domestic and international bandwidth and effectively criminalise VPN use. The bill was never fully ratified but was partially enacted through SCC directives in September 2022.
The Iran Primer (USIP)
- DecisionSupreme Leader Decrees Creation of Supreme Council of Cyberspace
Supreme Leader Khamenei established the Supreme Council of Cyberspace (SCC) by decree, designating it as Iran's apex internet-governance body with authority over all state agencies and mandate to create the National Cyberspace Center, develop the National Information Network, and set all cyberspace policy. The SCC is the central institution through which Iran's dual offensive-and-censorship cyber strategy is coordinated.
Wikipedia / Supreme Council of Cyberspace
- LawIran Officially Launches Cyber Police (FATA)
Iran formally stood up its Cyber Police unit (FATA) under the Islamic Republic of Iran Police on 23 January 2011, empowering it to investigate cybercrimes, monitor online content, and conduct surveillance operations. By 2018 FATA had arrested nearly 75,000 people, making it a primary instrument of domestic digital enforcement under the Computer Crimes Law.
Wikipedia / Iranian Cyber Police
- IncidentStuxnet Discovered, Triggers Iran's Decision to Build Offensive Cyber Capabilities
The Stuxnet worm, attributed to the US and Israel, was publicly identified in June 2010 after destroying an estimated 1,000 centrifuges at Iran's Natanz facility. The attack directly catalysed Iran's national cyber strategy: the regime responded by establishing the Supreme Council of Cyberspace, the Cyber Defence Command, and cultivating state-sponsored APT groups (APT33, APT34, APT35, APT42).
Wikipedia / Stuxnet
- Law · officialIran Enacts Computer Crimes Law (Law No. 71063), Foundational Cybersecurity Statute
Iran's Computer Crimes Law, approved by parliament in January 2009 and entering force in June 2009, established criminal penalties for unauthorised access, data interference, fraud, interception of communications, and publication of illegal or 'immoral' content online across 55 articles. The law also created the multi-agency Computer Crimes Detection and Operations Committee (CCDOC) for content oversight and remains the bedrock of Iran's domestic cybersecurity legal framework.
ILO NATLEX
Sources
- unodc.org/cld/uploads/res/document/computer-crimes-act_html/Computer_Crimes_Act
- ilo.org/dyn/natlex/natlex4.detail?p_lang=en&p_isn=91715&p_country=IRN&p_count
- article19.org/data/files/medialibrary/2921/12-01-30-FINAL-iran-WEB%5B4%5D.pdf
- en.wikipedia.org/wiki/Supreme_Council_of_Cyberspace_(Iran)
- article19.org/wp-content/uploads/2024/07/Supreme-Council-of-Cyberspace_final-2.pdf
- coe.int/en/web/octopus/-/iran-islamic-republic-of-
- iclg.com/practice-areas/cybersecurity-laws-and-regulations/iran
- mondaq.com/privacy-protection/1291984/e-commerce-law-and-cybersecurity-in-iran
- iranintl.com/en/202312105187
- iranintl.com/en/202507308530
- article19.org/resources/iran-parliaments-protection-bill-will-hand-over-complete-co
- iranhumanrights.org/2025/07/iran-proposed-cyber-bill-gives-authorities-sweeping-new-power
Next for Iran: Starting a BusinessRestricted
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026