Data protection & privacy law in Iraq (2026)
Data protection in Iraq: proposed.
Iraq has no comprehensive, enacted data protection law as of May 2026. A Draft Personal Data Protection Law was submitted to the Council of Representatives in 2021 but remains unenacted, continuing a pattern that includes an earlier cabinet-approved draft from 2019 that also lapsed. In the interim, fragmented privacy protections are sourced from constitutional provisions, the 1969 Penal Code, and sector-level CMC directives.
Legal framework
Draft Personal Data Protection Law (2021, not enacted); Communications and Media Commission (CMC) sector directives; 2005 Constitution Articles 17 & 40; E-Commerce Regulation No. 4/2025
Key points: data & privacy in Iraq
Draft PDPL (2021)
A comprehensive draft Personal Data Protection Law was introduced to Iraq's Council of Representatives in 2021 to cover both public and private sectors, establishing data-subject rights (consent, erasure, access) and requiring Records of Processing Activities. It has not been enacted as of May 2026.
No dedicated supervisory authority
The draft law proposes an Iraqi National Data Protection Authority (INDPA) to enforce compliance and levy administrative penalties, but this body does not yet exist. The CMC acts as the de facto sector regulator for telecoms and digital services in the meantime.
Constitutional privacy basis
Article 17 of Iraq's 2005 Constitution guarantees the right to personal privacy, and Article 40 protects the confidentiality of electronic and postal communications, forming the primary enforceable privacy rights in the absence of dedicated legislation.
CMC sector regulation
The Communications and Media Commission (CMC), an administratively independent body, enforces data-related obligations through sector directives and cybersecurity standards for telecoms and digital content operators. In June 2022 it published a Draft Data Classification Policy for public consultation.
E-Commerce Regulation No. 4/2025
Published in Official Gazette Issue No. 4818 (10 March 2025) and effective April 2025, this regulation requires e-commerce operators to publish a customer data privacy policy and disclose data-handling practices. It is the most recent binding instrument touching personal data, though implementation awaits the Ministry of Trade's licensing platform.
Residual Penal Code application
In the absence of modern data-protection law, authorities invoke Article 438 of the 1969 Penal Code (breach of confidentiality) for certain privacy violations, but the provision predates digital technology and is widely considered inadequate for contemporary data-protection needs.
Timeline of decisions
- LawE-Commerce Regulation No. 4 of 2025 Enters into Force
Iraq's Ministry of Trade issued binding e-commerce rules requiring licensed merchants to implement secure systems to protect customer personal data, collect only necessary information, obtain explicit consent before sharing data, and display a privacy policy on all digital storefronts. This is Iraq's first sector-specific data-security obligation for online commerce.
Mondaq / Etihad Law
Sources
- dataguidance.com/notes/iraq-data-protection-overview
- regulations.ai/regulations/RAI-IQ-NA-2021DRA-2021
- mondaq.com/contracts-and-commercial-law/1649696/iraqs-new-e-commerce-regulation
- accesspartnership.com/opinion/access-alert-introducing-iraqs-draft-data-classification-poli
- etihad-law.com/data-privacy-user-rights-protection/
- shafaq.com/en/Report/A-click-away-from-exposure-Iraq-s-privacy-dilemma-in-the-di
- washingtoninstitute.org/policy-analysis/profile-communications-and-media-commission
- etihad-law.com/iraq-ecommerce-regulation-update/
Next for Iraq: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026