Data protection & privacy laws in Iraq (2026)

A comprehensive draft Personal Data Protection Law was introduced to Iraq's Council of Representatives in 2021 to cover both public and private sectors, establishing data-subject rights (consent, erasure, access) and requiring Records of Processing Activities. It has not been enacted as of May 2026.

The draft law proposes an Iraqi National Data Protection Authority (INDPA) to enforce compliance and levy administrative penalties, but this body does not yet exist. The CMC acts as the de facto sector regulator for telecoms and digital services in the meantime.

Article 17 of Iraq's 2005 Constitution guarantees the right to personal privacy, and Article 40 protects the confidentiality of electronic and postal communications, forming the primary enforceable privacy rights in the absence of dedicated legislation.

The Communications and Media Commission (CMC), an administratively independent body, enforces data-related obligations through sector directives and cybersecurity standards for telecoms and digital content operators. In June 2022 it published a Draft Data Classification Policy for public consultation.

Published in Official Gazette Issue No. 4818 (10 March 2025) and effective April 2025, this regulation requires e-commerce operators to publish a customer data privacy policy and disclose data-handling practices. It is the most recent binding instrument touching personal data, though implementation awaits the Ministry of Trade's licensing platform.

In the absence of modern data-protection law, authorities invoke Article 438 of the 1969 Penal Code (breach of confidentiality) for certain privacy violations, but the provision predates digital technology and is widely considered inadequate for contemporary data-protection needs.