Comprehensive regime
Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)
Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38Constitution of the Islamic Republic of Afghanistan
In force since 26 January 2004. Binds public and private bodies.
What this law does
Article 37, read verbatim in full, secures freedom and confidentiality of correspondence and communications of individuals, whether by letter, telephone, telegraph or other means, from state inspection absent authorization by law.
Article 38 makes personal residences immune from entry or search without the owner's permission or a court order, subject only to an evident crime exception under which the responsible official must still obtain a court order after the fact, within the time limit set by law.
Neither article defines personal data, sets processing conditions, or establishes a supervisory authority; both are bare constitutional rights enforceable against the state rather than a comprehensive data protection regime, the same shape as the constitutional privacy provisions of Timor-Leste and Palestine elsewhere in this corpus.
On 4 and 7 January 2026 the Taliban administration promulgated a wholly new Criminal Procedure Code and Penal Principles of Taliban Courts (119 articles), effective immediately with no public consultation, which multiple independent outlets describe as replacing the prior penal architecture and further undermining the 2004 Constitution's operative status; that framework's text is unpublished, so its treatment of personal data is unknown, and no published instrument repeals or supersedes Articles 37 or 38, so this instrument stays coded in effect.
What it requires