Skip to content
World Watch

Cybersecurity law & regulation in Iraq (2026)

Cybersecurity in Iraq: proposed.

Iraq has no enacted cybercrime or comprehensive cybersecurity statute as of 2026. A Draft Cybercrime Law has been in circulation since 2011, was suspended by parliament in May 2021 over free-speech concerns, and remains unenacted despite repeated attempts at reintroduction. Institutional capacity has grown, the Ministry of Interior upgraded its Cybersecurity Centre to a full Cybersecurity Directorate in 2025, but mandatory breach-notification obligations and a general data-protection regime do not exist.

Last verified Official sources first · MethodologyCompare Iraq with other countries

Legal framework

No dedicated cybersecurity or cybercrime law in force; obligations derived from Iraqi Penal Code No. 111 of 1969 and Civil Code No. 40 of 1951, supplemented by sector-specific rules (Banking Law No. 94/2004; CPA Order 65/2004 for communications/CMC); National Cybersecurity Strategy 2022-2025 and Ministry of Interior Cybersecurity Directorate (established 2025) constitute the institutional framework

Key points: cybersecurity in Iraq

  1. No enacted cybersecurity law

    Iraq has no dedicated cybercrime or cybersecurity statute. Courts rely on Penal Code No. 111/1969 and Civil Code No. 40/1951, instruments not designed for digital offences that leave significant enforcement gaps.

    tamimi.com stimson.org

  2. Draft Cybercrime Law stalled

    A Draft Information/Cybercrime Law (originated 2011, revised multiple times) was formally suspended by the Iraqi Parliament in May 2021 due to concerns it would restrict freedom of expression; reintroduced for a vote in 2022 but still not enacted as of 2026, with debate ongoing.

    hrw.org insm-iq.org loc.gov

  3. National Cybersecurity Strategy 2022-2025

    The Ministry of Interior approved Iraq's first National Cybersecurity Strategy in December 2022, setting policy goals for cyber defence and establishing the basis for a dedicated Cybersecurity Centre under the ministry's authority.

    itu.int iraq-businessnews.com

  4. Ministry of Interior Cybersecurity Directorate (2025)

    The Ministry of Interior's Cybersecurity Centre was upgraded to a full Cybersecurity Directorate in 2025, described as 'a strategic response to the shifting digital threat landscape,' and works alongside a high-level inter-agency cybersecurity committee convened by the Prime Minister.

    stimson.org iraq-businessnews.com

  5. No breach-notification or data-protection obligations

    Iraq has no general data-protection law and no Data Protection Authority. There is no statutory obligation to notify regulators or affected individuals of data breaches; notification is considered prudent but carries no legal mandate.

    dataguidance.com

  6. Sector-specific and CMC rules provide partial coverage

    The Communications and Media Commission (CMC), established under CPA Order 65/2004, issues digital-content directives and a draft Data Classification Policy. Banking Law No. 94/2004 and Central Bank of Iraq regulations impose some cybersecurity-adjacent obligations on financial institutions.

    accesspartnership.com tamimi.com

Timeline of decisions

  1. Enforcement · official
    INTERPOL Operation Ramz: Iraq Joins First MENA Cybercrime Enforcement Action

    Iraq participated in Operation Ramz (October 2025-February 2026), INTERPOL's first MENA-wide cybercrime crackdown across 13 countries, resulting in 201 arrests, 382 suspects identified, and 53 malicious servers seized. Iraq's Cybersecurity Directorate simultaneously chaired the INTERPOL Cybercrime Working Group for the Gulf/MENA region, marking Iraq's formal integration into international cyber-enforcement architecture.

    INTERPOL

  2. Decision
    Prime Minister Inaugurates National Cybersecurity Centre; Later Elevated to Directorate

    PM Mohammed Al-Sudani inaugurated the National Cybersecurity Centre under the Ministry of Interior, describing it as a historic step in integrating cyber defence into the national security system. The centre was shortly afterwards elevated to a Cybersecurity Directorate, headed by Brigadier General Dr Hassan Hadi Lazeez, giving it permanent institutional standing and a mandate to lead national cyber incident response.

    Iraq Business News

  3. Law · official
    UN General Assembly Adopts Convention against Cybercrime; Iraq Among Signatories

    The UN General Assembly adopted the landmark UN Convention against Cybercrime, which opened for signature in Hanoi in October 2025 with 65 countries signing, including Iraq. The convention imposes obligations to criminalise computer intrusion, fraud, and CSAM, and requires parties to cooperate on cross-border investigations and electronic-evidence exchange.

    UNODC

  4. Guidance
    Ministry of Interior Approves Iraq's First National Cybersecurity Strategy (2022-2025)

    Iraq's Ministry of Interior approved the country's inaugural national cybersecurity strategy, establishing a policy roadmap covering critical-infrastructure protection, capacity building, and inter-agency coordination. The strategy directly paved the way for the 2025 Cybersecurity Centre inauguration, though implementation gaps and under-resourcing have persisted.

    Stimson Center

  5. Decision
    Parliament Suspends Draft Cybercrime Law after Rights Outcry

    The Iraqi Parliament suspended the draft Law on Combating Cybercrimes after intense pressure from civil society and international human-rights organisations, with Speaker Al-Halbousi vowing it 'will not pass' in its current form. The bill's overbroad provisions, including criminalising online content deemed harmful to 'national unity', were condemned as threats to press freedom and political dissent.

    Human Rights Watch

  6. Law · official
    Parliament Completes Second Reading of Draft Law on Combating Cybercrimes

    Iraq's Council of Representatives completed the second reading of a revised cybercrime bill seeking to criminalise unauthorised computer access, online fraud, and certain content offences, moving it toward a vote. Vaguely worded provisions on harming 'national unity' and 'social peace' online drew immediate condemnation and ultimately led to suspension in 2021.

    Library of Congress Global Legal Monitor

  7. Law
    Draft Information Crimes Law Reintroduced with Minor Amendments

    Because the 2013 parliamentary withdrawal decision was never formally enacted into law, the original draft Iraqi Information Crimes Law was reintroduced with slight amendments in January 2019, reopening a divisive legislative debate and setting the stage for the 2020 second reading and 2021 suspension.

    Al Tamimi & Company

  8. Decision · official
    IQ-CERT (Iraq Cyber Events Response Team) Established

    Iraq established its first national incident-response capability, IQ-CERT, to monitor, detect, and coordinate responses to cybersecurity incidents affecting government networks. Its creation marked Iraq's first formal institutional cybersecurity capacity and enabled participation in international CERT cooperation networks.

    Cybil Portal (ITU/UNIDIR)

Sources

  1. stimson.org/2025/cybercrime-is-iraqs-next-big-challenge/
  2. insm-iq.org/en/?p=875
  3. tamimi.com/law-update-articles/cybercrime-legislation-iraq/
  4. dataguidance.com/notes/iraq-data-protection-overview
  5. loc.gov/item/global-legal-monitor/2021-01-14/iraq-parliament-considers-new-an
  6. hrw.org/news/2021/05/07/iraq-parliament-suspends-draconian-cybercrimes-bill
  7. itu.int/en/ITU-D/Cybersecurity/Documents/National_Strategies_Repository/00056
  8. iraq-businessnews.com/2025/01/13/iraq-launches-national-cybersecurity-centre/
  9. accesspartnership.com/opinion/access-alert-introducing-iraqs-draft-data-classification-poli
  10. ncsi.ega.ee/country/iq/

Next for Iraq: Starting a BusinessRestricted

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026