Cybersecurity law & regulation in Iraq (2026)

Iraq participated in Operation Ramz (October 2025-February 2026), INTERPOL's first MENA-wide cybercrime crackdown across 13 countries, resulting in 201 arrests, 382 suspects identified, and 53 malicious servers seized. Iraq's Cybersecurity Directorate simultaneously chaired the INTERPOL Cybercrime Working Group for the Gulf/MENA region, marking Iraq's formal integration into international cyber-enforcement architecture.

Iraq's Ministry of Trade issued binding e-commerce rules requiring licensed merchants to implement secure systems to protect customer personal data, collect only necessary information, obtain explicit consent before sharing data, and display a privacy policy on all digital storefronts. This is Iraq's first sector-specific data-security obligation for online commerce.

The Communications and Media Commission formally issued Iraq's first comprehensive digital-platform regime, covering social media, video-sharing, e-commerce, fintech, and AI platforms. Operators must meet cybersecurity international best practices, implement controls against unauthorized interception, report breaches within 24-72 hours, and obtain a CMC licence or registration before serving Iraqi users.

PM Mohammed Al-Sudani inaugurated the National Cybersecurity Centre under the Ministry of Interior, describing it as a historic step in integrating cyber defence into the national security system. The centre was shortly afterwards elevated to a Cybersecurity Directorate, headed by Brigadier General Dr Hassan Hadi Lazeez, giving it permanent institutional standing and a mandate to lead national cyber incident response.

The UN General Assembly adopted the landmark UN Convention against Cybercrime, which opened for signature in Hanoi in October 2025 with 65 countries signing, including Iraq. The convention imposes obligations to criminalise computer intrusion, fraud, and CSAM, and requires parties to cooperate on cross-border investigations and electronic-evidence exchange.

Iraq's Ministry of Interior approved the country's inaugural national cybersecurity strategy, establishing a policy roadmap covering critical-infrastructure protection, capacity building, and inter-agency coordination. The strategy directly paved the way for the 2025 Cybersecurity Centre inauguration, though implementation gaps and under-resourcing have persisted.

The Iraqi Parliament suspended the draft Law on Combating Cybercrimes after intense pressure from civil society and international human-rights organisations, with Speaker Al-Halbousi vowing it 'will not pass' in its current form. The bill's overbroad provisions, including criminalising online content deemed harmful to 'national unity', were condemned as threats to press freedom and political dissent.

Iraq's Council of Representatives completed the second reading of a revised cybercrime bill seeking to criminalise unauthorised computer access, online fraud, and certain content offences, moving it toward a vote. Vaguely worded provisions on harming 'national unity' and 'social peace' online drew immediate condemnation and ultimately led to suspension in 2021.

Because the 2013 parliamentary withdrawal decision was never formally enacted into law, the original draft Iraqi Information Crimes Law was reintroduced with slight amendments in January 2019, reopening a divisive legislative debate and setting the stage for the 2020 second reading and 2021 suspension.

Iraq established its first national incident-response capability, IQ-CERT, to monitor, detect, and coordinate responses to cybersecurity incidents affecting government networks. Its creation marked Iraq's first formal institutional cybersecurity capacity and enabled participation in international CERT cooperation networks.

Coalition Provisional Authority Order No. 65, signed on 20 March 2004, created the CMC as Iraq's independent regulator for telecommunications, radio, and media, the foundational institutional pillar of Iraq's entire communications governance framework. The CMC later became the primary regulatory body for digital platforms, cybersecurity obligations, and online content in post-2003 Iraq.