Data protection & privacy law in Iran (2026)
Data protection in Iran: sectoral rules.
Iran has no single comprehensive (GDPR-style) personal-data-protection law in force; data protection relies on a patchwork of sector-specific provisions in its E-Commerce and Computer Crimes laws plus constitutional privacy guarantees. A comprehensive Personal Data Protection and Safeguarding Draft Act was prepared in 2018 (an earlier bill was withdrawn in 2015) but remains unenacted with no clear timeline. There is no independent, operational data-protection supervisory authority today; the draft would create a Data Protection Commission chaired by the ICT Minister, whose independence has been criticized.
Legal framework
No comprehensive data-protection statute in force. Privacy/data is governed by scattered provisions: the Electronic Commerce Law (2004, Chapter on Protection of Personal Data), the Computer Crimes Law (2009), Constitution Art. 25, and the non-binding Citizens' Rights Charter (2016). A comprehensive 'Personal Data Protection and Safeguarding Draft Act' has been pending/stalled since 2018.
Key points: data & privacy in Iran
No comprehensive law in force
Iran has not enacted a unified personal-data-protection statute; protection depends on fragmented provisions across several laws rather than a dedicated framework.
Electronic Commerce Law (2004)
Contains a chapter on the protection of personal data in electronic transactions, restricting collection/processing and storage of personal 'data messages' without consent.
Computer Crimes Law (2009)
Criminalizes unauthorized access to, interception of, and unlawful dissemination of personal/computer data, providing indirect data-security protection.
Draft comprehensive act stalled
The 'Personal Data Protection and Safeguarding Draft Act' (prepared 2018 by the ICT Ministry and Parliament's Research Center; an earlier bill was withdrawn in 2015) draws on GDPR principles but has not been ratified and has no clear timeline for passage.
No independent supervisory authority
There is currently no operating data-protection authority. The draft would establish a Personal Data Protection Commission chaired by the Minister of Communications and ICT, alongside a supervisory council; critics note its government-dominated composition undermines independence.
Constitutional and charter guarantees
Constitution Article 25 protects privacy of correspondence/communications, and the 2016 Citizens' Rights Charter affirms privacy and data rights, but the Charter is a non-binding policy document, not enforceable legislation.
Sources
Next for Iran: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026