Iraq

Iraq has no comprehensive personal-data-protection law. This is a sourced absence, not an unresearched gap: a draft Personal Data Protection Law has circulated since 2019, was revised through 2024-2026, and remains unenacted as of a fresh check, with officials continuing to state an expectation of finalizing it by the end of 2026.

The 2005 Constitution supplies two general privacy provisions, confirmed at primary source: Article 17 (personal privacy and home sanctity) and Article 40 (communications privacy), both enforceable only through ordinary courts and creating no processing regime, data-subject rights, or supervisory structure of their own.

The nearest thing to a binding data-protection duty is a Communications and Media Commission (CMC) Framework Regulation for Digital Platforms and Services, issued 17 February 2025 and read in full from the regulator's own site: it requires licensed or registered digital platforms to commit to "data protection and privacy measures that comply with Iraqi laws, including data localization where necessary," while separately stating, in its own text, that "the CMC will be publishing a personal data protection law in due time."

The regulator's own document thus confirms, as of February 2025, that no such law existed yet for platforms to comply with; the one concrete, citable duty is the licensing-tied localization condition, not a comprehensive regime. Sensitive categories, biometrics, data-subject rights, and breach notification are confirmed absent in both the constitutional text and the CMC regulation, rather than merely unresearched.

Open-web crawling of public pages carries no dedicated Iraqi statute. Iraq enacted the Electronic Signature and Electronic Transactions Law No. 78 of 2012 (Official Gazette No. 4256, 5 November 2012), reported to carry offences on electronic records; its operative text is not reproduced here, so its provisions are not described. The 1969 Penal Code predates computer-specific offences and contains none.

The Draft Law on Combating Information Technology Crimes, which would criminalize unauthorized access to computer systems, remained before the Council of Representatives, unenacted, as of a 2026 position paper.

Copyright protects a database as a compilation rather than through a separate sui generis right: Law No. 3 of 1971 on Copyright, as amended by Coalition Provisional Authority Order No. 83 of 1 May 2004, lists compilations of data among the protected work types and extends the reproduction right to copying onto a digital or electronic storage medium, with no text-and-data-mining or AI-training-specific exception anywhere in the amended text.

No statute or case law addressing terms-of-service enforceability, robots.txt's legal weight, or an unfair-competition claim specific to scraping has been located; personal-data reach over scraped public data is researched under the privacy topic, which finds no comprehensive data-protection law and only a licensing-tied data-localization condition.

Iraq has no enacted federal statute setting a general reasonable-security or information-security-programme duty on a private-sector operator, no enacted product-security or connected-device requirement on a manufacturer; the Central Bank of Iraq's 2025 Standards Booklet sets the banks' information-technology resilience standard (B7), filed as a row of its own.

This is a researched absence rather than an unresearched gap, but a partial one: the Communications and Media Commission (CMC), Iraq's telecom and media regulator, ratified the final form of a licensing bylaw for companies specialized in cybersecurity services at its Board of Commissioners session of 17 March 2025, and published the bylaw as a PDF to its own site around 14 to 17 April 2025 under the title (English, as CMC's own media-library metadata names it) "The regulatory regulation on the organization of the work of companies specialized in cybersecurity services in the Republic of Iraq."

The PDF has no extractable text layer (confirmed against the downloaded bytes with pypdf: 16 pages, 15 characters of text-layer content), so a verification pass independently downloaded the PDF through the crawler infrastructure and OCR'd it on the leased GPU (Surya, no extraction errors), recovering its Arabic text in full.

That text confirms the occupational-licensing reading the title suggested: Article 4 states the bylaw applies to "the entities (public and private sector companies) providing cybersecurity services in the Republic of Iraq" (المادة (٤): نطاق التطبيق. تطبق هذه اللائحة على الجهات (شركات القطاع العام والخاص) التي تقدم خدمات الأمن السييراني في جمهورية العراق), naming the cybersecurity-service vendor as the bound party rather than the client organization that buys the service.

Article 12's Obligations clause does bind that licensed vendor to a real set of security-posture duties on its own operations, including implementing cybersecurity-programme applications consistent with Iraq's national cybersecurity strategy, providing a risk-management service with a clear methodology to protect informational and technical assets, protecting the personal data it collects or processes as a service provider, encrypting its own electronic information assets, periodically reviewing its own cybersecurity policies, and notifying the competent authorities of a technical problem or security breach in any activity it provides, but every one of those duties runs to the licensed cybersecurity-service company itself, never to an operator, manufacturer, or critical-infrastructure owner of the kind this topic's four law families track.

That is the same shape this corpus already treats as role-inexpressible for this topic, matching Micronesia's C.B. No. 24-14 §§416-417 and Vanuatu's licensed-cybersecurity-vendor precedent: a licensing and conduct regime for the vendor industry rather than a duty on the operators or manufacturers this topic covers, so it is named here in prose rather than filed as an instrument.

The same OCR pass confirms the Board's 17 March 2025 session also discussed, and did not adopt at that session, a draft information-technology-crimes law, consistent with the sourced finding already on file for this jurisdiction's scraping topic.

The same CMC announcement confirms, independently of the bylaw's content, that the Board separately discussed and did not adopt at that same 17 March 2025 session a draft law on combating information-technology crimes, consistent with the sourced finding already on file for this jurisdiction's scraping topic that this is a draft computer-misuse bill; it is not restated as a security-topic instrument, because an intruder-offense statute belongs to the scraping topic, not here, and this visit found no article inside it reaching an operator's own security posture.

This jurisdiction's CMC Framework Regulation for Digital Platforms and Services (17 February 2025), which conditions platform licensing on a data-localization commitment, is already filed under this jurisdiction's privacy topic and is not repeated here, because its trigger is the platform's handling of personal data rather than a security-posture duty of its own.

The Central Bank of Iraq (CBI), the likeliest source of a bank-security or IT-security directive, could not be searched directly: its site-level search parameter returned the homepage unchanged rather than filtered results, direct path guesses for its "Instructions and Controls" (التعليمات والضوابط) circulars section were blocked by a Barracuda web-application firewall that explicitly warns further attempts risk being blocked outright, and a 5,000-URL pull of the Internet Archive's Wayback Machine index of archived cbi.iq pages contained no path bearing the Arabic words for security, cyber, or instructions among its slugs.

CBI's own homepage lists only four banking statutes (the Central Bank Law No. 56 of 2004, the Banking Law No. 94 of 2004, the Islamic Banks Law No. 43 of 2015, and the Anti-Money-Laundering and Counter-Terrorist-Financing Law No. 39 of 2015), none of them a cybersecurity or IT-security instrument.

The Iraqi Legal Database of the Higher Judicial Council (iraqld.hjc.iq), one of this jurisdiction's two seeded sources, returned a Cloudflare bot-challenge page (HTTP 403, "Attention Required") even after the crawler escalated to its stealth browser tier, and is recorded as blocked rather than as evidence of absence.

The Ministry of Justice's site (moj.gov.iq), the other seeded source and publisher of the Al-Waqai Al-Iraqiya official gazette, was reachable and confirms it operates a dedicated Official Gazette directorate and a gazette-publications section, but no full-text search entry point for a specific security-related gazette issue was found within this visit's budget, and none was pursued without a specific citation lead.

No web presence or published directive was located for the Ministry of Interior's Cybersecurity Center, named only in passing in a CMC news item as a body CMC coordinated with while drafting its own bylaw. No national cybersecurity strategy document, binding or non-binding, was located through any of the sources reachable in this visit, so this jurisdiction's summary does not assert one exists or does not; that remains an open question rather than a finding either way.

No jurisdiction-specific search was performed for a Kurdistan Region instrument distinct from this federal research; the Kurdistan Parliament and its own Waqi Kurdistan gazette are a separate legislative and publishing apparatus from the Council of Representatives and Al-Waqai Al-Iraqiya, and any KRG-specific cybersecurity instrument remains unresearched here.

This visit's web search budget was already exhausted, at zero of its session allowance, before research began, which limited discovery to this jurisdiction's two seeded sources (the Iraqi Legal Database and the Ministry of Justice) plus direct navigation of the CMC and CBI sites and their own WordPress and Wayback Machine indices; a future visit with search available may find sources these could not.

The Central Bank of Iraq's Standards Booklet 2025 requires every private bank to establish infrastructure that is resilient and can withstand cyberattacks.

Iraq has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, and no recognized hot-news misappropriation doctrine distinct from ordinary copyright law; each of those dimensions is a sourced absence rather than an unresolved question.

The relevant instrument is Law No. 3 of 1971 on Copyright, whose Article 14 lets any person, once a work is published, make short analyses and quotations for conveying, controversy, education, or information, provided the author's name and source are credited, and whose Article 16 separately lets newspapers, radio, and television publish, without the author's permission and by way of information, speeches read in public political, administrative, or judicial sessions and public political meetings addressed to the people.

No located Iraqi court decision applies either exception to a systematic news aggregator, as opposed to a traditional press review or broadcast report, and nothing in the Law addresses hyperlinking, framing, or a machine-readable text-and-data-mining reservation.