IranElectronic Commerce Law (2003), Personal Data Chapter
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights
- Audit expectation
- none
What it requires
- An app that stores, processes, or distributes data revealing a Iranian resident's tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition needs their explicit consent first. Any other collection or processing of personal data needs consent for a specified, described purpose, must be limited to that purpose, must stay accurate, and must let the person access their own data with a right to have it corrected or completely removed. The law names no biometric category, so a voiceprint or faceprint is not subject to a heightened consent, retention, or destruction standard beyond the general consent-based rule, and nothing in this chapter conditions moving personal data out of Iran or requires notifying anyone after a security incident. Violating Article 58's sensitive-data consent rule is a criminal offense (one to three years' imprisonment); separately, Article 78 makes a private or governmental institution liable to compensate a person damaged through electronic transactions by its deficiency or fault.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 71 punishes anyone who in electronic transactions violates the terms of Articles 51 and 58 with one to three years' imprisonment; Article 72 applies the maximum to certificate service providers and other responsible institutions, and Article 73 adds three months to one year and a cash penalty of 50,000,000 rials where such an offence follows a certificate service provider's negligence.
Who enforces it
Settledness
- As of
- Open questions
- Which regulations does Article 59(e) mean by while adhering to the regulations, as a limit on the data subject's right to request the complete removal of the computer files of the person's personal data messages?
- Which body exercises the supervision and control of personal data messages that Article 61 leaves to Chapter Four of the Law and relevant regulations?
What it makes you log
Logging duty
Articles 58 to 61 require explicit consent before sensitive private data messages are stored, processed or distributed (Article 58), set purpose, minimization and accuracy terms and give the data subject access to the computer files holding the person's data, with a right to remove or amend them (Article 59), and defer medical data and supervision to other regulations (Articles 60 and 61). None of the four articles requires a person to make, keep or produce a log or record of processing. The data subject's access in Article 59(d) is access to the personal data itself and not to a log. Article 81 (originators, addressees and archivists keep copies of a data message) and Articles 8 and 11 (retention of a data message in its original form) sit outside the cited articles and are not covered by this row. The English wording is the WIPO Lex translation of the Persian law, and the Persian text is the authoritative one.
- Kind
- None
- As of
What this law does
Article 58 requires explicit consent before storing, processing, or distributing data revealing tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition; this is Iran's complete sensitive-category list and it names no biometric category.
Article 59 sets a general consent-based processing standard (specified purpose, data minimization, accuracy) and gives the data subject access to their own files with a right to correct or completely remove them. Article 60 defers medical and health-record data to separate, unlocated regulations, and Article 61 defers exceptions and "supervision and control" to other chapters without spelling out a dedicated regulator.
Criminal enforcement is one to three years' imprisonment under Article 71 (enhanced for institutional offenders under Article 72), with no described administrative penalty scheme. Article 78 separately makes the private or governmental institutions involved liable for compensation when damage is done to a person through electronic transactions by their deficiency or fault, physical disconnection of the electronic connection excepted.
No cross-border-transfer provision and no breach-notification duty were found anywhere in the chapter. None of the Law's 81 articles states a day on which it comes into force. Under Article 2 of the Civil Code a law takes effect throughout the country fifteen days after its publication unless it provides otherwise. No notice stating the resulting day for this Law has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .