LexLint.ioBeta

Know the law your code answers to.

Law / Iran

Iran

4 of 11 named instruments researched to a stage, across three of the ten areas of law we track: 4 in force. As of .

  1. AI law
  2. Privacy law 1
  3. Scraping law 2
  4. Cybersecurity law
  5. Communications law not researched
  6. Content moderation law not researched
  7. Product and AI liability law not researched
  8. Digital accessibility law not researched
  9. Age gating law
  10. Reuse law 1

in forcenot yet in forceblocked by a courtproposedno longer in force

Privacy law1 instrument, 1 in force

Research summary (197 words)

Iran has no comprehensive personal-data-protection law. The closest thing is a limited chapter of the Electronic Commerce Law of 2003, Articles 58 to 61, read in full from an official WIPO Lex-hosted text (72,766 characters, not truncated); a citation of the personal-data chapter as "Arts. 58-63" is wrong, since it sweeps in Articles 62-63, the Act's separate copyright chapter.

A broader "Protection of Personal Data" bill has been under Majlis review since approximately 2018 and remains unenacted as of a fresh check; no citable primary bill text was located, so it is not authored here.

Biometrics, cross-border transfer, and breach notification are confirmed absent from the full chapter rather than merely unresearched: Article 58's sensitive-category list (tribal or ethnic origin, religious or moral belief, ethical characteristics, physical, psychological, or sexual condition) names no biometric category, and the chapter contains no cross-border-transfer provision and no security-incident notification duty (the only "breach" heading found is the criminal-offense section title, meaning violation of the law, not a notification duty).

Iran also operates a mandatory biometric national identity card program, but no citable statute or regulation establishing it is located; that is recorded as a checked-and-not-found gap, not an authored instrument.

Sensitive categories

Electronic Commerce Law (2003), Personal Data Chapter

Electronic Commerce Law, approved by the Islamic Consultative Assembly, 2003, Arts. 58-61 (personal-data chapter)Electronic Commerce Law official text hosted by WIPO Lex, a UN-agency legal database republishing verbatim government-supplied texts

In force. Binds public and private bodies.

What this law does

Article 58 requires explicit consent before storing, processing, or distributing data revealing tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition; this is Iran's complete sensitive-category list and it names no biometric category.

Article 59 sets a general consent-based processing standard (specified purpose, data minimization, accuracy) and gives the data subject access to their own files with a right to correct or completely remove them. Article 60 defers medical and health-record data to separate, unlocated regulations, and Article 61 defers exceptions and "supervision and control" to other chapters without spelling out a dedicated regulator.

Criminal enforcement is one to three years' imprisonment under Article 71 (enhanced for institutional offenders under Article 72), with no described administrative penalty scheme. Article 78 separately makes the private or governmental institutions involved liable for compensation when damage is done to a person through electronic transactions by their deficiency or fault, physical disconnection of the electronic connection excepted.

No cross-border-transfer provision and no breach-notification duty were found anywhere in the chapter. None of the Law's 81 articles states a day on which it comes into force. Under Article 2 of the Civil Code a law takes effect throughout the country fifteen days after its publication unless it provides otherwise. No notice stating the resulting day for this Law has been located.

What it requires

Scraping law2 instruments, 2 in force

Research summary (345 words)

Iran has no scraping-specific statute, so general law governs each dimension separately, and the record is thin: only two of the seven registered families are grounded in a citable official text.

Open-web crawling of a public page and computer-misuse law are governed by the Computer Crimes Law (Law No. 71,063 of 2009), which secondary sources (Stanford's World Intermediary Liability Map, an ARTICLE 19 legal analysis) describe as criminalising unauthorised access to a computer or telecommunications system; no official gazette or government-portal text of that Law has been located, only the intermediary-liability commentary on its content-filtering articles, so no instrument is authored on it here and the unauthorised-access provision's exact terms remain unverified against a citable primary source.

No Iranian court decision on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper was located.

The Electronic Commerce Law of 2003 extends the closed, no-text-and-data-mining quotation exception of the Act on Protection of Authors, Composers and Artists Rights, 1970 (recorded under the aggregation topic for this jurisdiction) to works transmitted as electronic data messages, while separately exempting a temporary, inevitable copy made in the course of network data-message processing; that Law confers no sui generis database right, listing 'protection of databases' only as one of several intellectual-property regimes a data message may fall under without creating a distinct right, and its related-rights coverage does not extend beyond authors, composers and artists.

The same Law's trade-secrets sections protect a business's confidential electronic information against illegal acquisition or disclosure in order to protect legitimate and fair competition, which is Iran's closest analogue to an unfair-competition or misappropriation doctrine reaching scraped proprietary data.

Personal data scraped from a public Iranian website is reached by the Electronic Commerce Law's personal-data chapter (Arts. 58-61), landed under the privacy topic for this jurisdiction; that chapter's duty attaches to the data itself rather than to the act of collection, so it is not restated as a scraping instrument here. No Iranian statute or reported case assigns legal weight to a robots.txt directive or states an AI-training-specific rule beyond the temporary-copy exception below.

Unfair competition

Electronic Commerce Law, Trade Secrets Chapter

Electronic Commerce Law (2003), Arts. 64-65 (trade secrets) and Art. 75 (penalty)Electronic Commerce Law official text, WIPO Lex

In force. Binds public and private bodies.

What this law does

Article 64 makes the illegal acquisition of a trade or economic secret, or its disclosure to a third party in an electronic environment, an offence, stated as protecting legitimate and fair competition in electronic transactions.

Article 65 defines an electronic trade secret broadly to include information, formulas, software and programs, methods, unpublished writings, business and transaction methods, strategies, plans, financial information and customer lists that have economic value, are inaccessible to the public, and for which reasonable protective efforts have been made. Article 75 sentences a violator to corrective imprisonment of six months to two and a half years or a fine of up to 50,000,000 Rials.

No robots.txt-specific or AI-training-specific rule is stated; a scraper's bulk acquisition of a business's non-public electronic data could fall within Article 64 if the data meets Article 65's economic-value and inaccessibility tests. None of the Law's 81 articles states a day on which it comes into force. Under Article 2 of the Civil Code a law takes effect throughout the country fifteen days after its publication unless it provides otherwise. No notice stating the resulting day for this Law has been located.

What it requires

Reuse law1 instrument, 1 in force

Research summary (165 words)

Iran has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Act on Protection of Authors, Composers and Artists Rights, 1970 governs an aggregator's reproduction of news content.

Article 7 permits quoting from a published work and referring to it only for a closed list of purposes, literary, scientific, technical or educational purposes, and criticism or praise, with the source named and the customary limitations observed; the list names no general news-reporting or press-summary category and no text-and-data-mining or machine-processing purpose.

No statute or reported Iranian decision addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law was located. The Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.

Neighbouring rights specific to press publishers do not appear in the Act, which is organised around the individual author's rights.

Snippet reproduction

Copyright Act (1970), Quotation Exception

Act on Protection of Authors, Composers and Artists Rights, 1970, Art. 7 (quotation exception)Act on Protection of Authors, Composers and Artists Rights, 1970, official English translation, WIPO Lex

In force. Binds public and private bodies.

What this law does

Article 7 permits quoting from a published work and referring to it, but only for literary, scientific, technical or educational purposes, and in criticism or praise, provided the source of the quotation is named and the customary limitations are observed; a note excuses naming the source only where a teacher reproduces the work for non-commercial classroom use.

The list is closed and names no general news-reporting, press-summary or commentary-on-current-events category distinct from criticism or praise, and no text-and-data-mining or automated-processing purpose.

Article 23 makes publishing, distributing or broadcasting the whole or part of another person's protected work without permission, or under a false attribution, an offence carrying corrective imprisonment of six months to three years, which is the penalty a reproduction falling outside Article 7's closed list would face. The Act's text sets no commencement day of its own, and no Official Gazette notice stating the day it came into force has been located.

What it requires

Where nothing was found3 areas of law

These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.

AI law

Iran has no AI-transparency or output-labeling law binding a private developer.

The Supreme Council of the Cultural Revolution approved a National Artificial Intelligence Document on , setting national policy goals and creating the basis for a National Organization of Artificial Intelligence under presidential supervision; the Majlis separately adopted a National AI Plan on appropriating research and infrastructure funding, later amended to formally establish that Organization.

Both instruments direct government ministries and agencies rather than imposing a disclosure, labelling or bot-disclosure duty on a private operator, so neither is authored here as an instrument.

The Majlis passed a law titled Combating the Spread of Untrue News Content in Cyberspace on ; secondary reporting describes it as later reported in force and, in some accounts, as requiring the watermarking of AI-generated or synthetic media and creating a content-verification committee, but no Guardian Council gazette text or other primary legislative text confirming its final approved terms or a commencement date has been located, so it is not authored as an instrument.

A primary Persian-language source (the Majlis research centre rc.majlis.ir or the presidency's legal portal dotic.ir) or an official gazette notice would be needed to confirm whether that Law binds a private developer and on what terms.

As of .

Cybersecurity law

Iran's official legal and regulatory portals were not reachable through the crawler infrastructure.

The Central Bank of Iran's site (cbi.ir) returned an Imperva/Incapsula JavaScript challenge ("Please enable JavaScript to view the page content") at the stealth tier rather than page content, the Deputy for Legal Affairs' legislative database (dotic.ir) returned an explicit geographic access block ("The request has been blocked from your IP or your location"), and the Islamic Consultative Assembly's research portal (rc.majlis.ir), the Communications Regulatory Authority's site (cra.ir), and the Passive Defense Organization's site (paddefa.ir, a DNS resolution failure) could not be connected to at all through the compliant or stealth tiers.

No independently reachable secondary legal database that indexes Iranian law names a cybersecurity, critical-infrastructure-protection, product-security, or incident-reporting statute or regulation for Iran: WIPO Lex's Iran collection is limited to the Electronic Commerce Law (2003) and intellectual-property statutes already researched under the privacy, scraping, and aggregation topics for this jurisdiction, and the FAO's FAOLEX database's one Iran document outside those areas is an energy-sector captive-power-plant law with no security content.

Stanford's World Intermediary Liability Map, read in full, confirms that the Computer Crimes Law (Law No. 71,063 of 2009), already filed under the scraping topic's computer-misuse family for this jurisdiction, is an intermediary-liability and content-filtering statute: it imposes an obligation on internet service providers to block or filter content the law treats as generating crime (Art. 21), to implement the orders of the Committee for Determining Instances of Criminal Web Content and report illegal content to it (Arts. 22-23), and it separately criminalizes facilitating access to obscene content (Art. 15) and non-consensual disclosure of a person's private images, audio, or video (Art. 17).

No product-security requirement, sector cyber-resilience regime, security-baseline duty, or vulnerability-and-incident-reporting duty to a CERT or regulator is described anywhere in that summary, so the Computer Crimes Law is not restated here.

Iran is understood to operate a national CERT (Maher/APA) under the Passive Defense Organization and the ICT ministry and a Supreme Council of Cyberspace (also called the National Cyberspace Council), and the Passive Defense Organization is understood to issue critical-infrastructure-protection directives, but no citable, verifiable text of a binding regulation reaching a private-sector operator, bank, telecommunications carrier, or connected-device manufacturer was located through any reachable channel.

This is an access gap in the corpus rather than a researched absence, and it should not be read as evidence that no such regulation exists. The Central Bank of Iran's electronic-banking and payment-system cybersecurity circulars remain entirely unverified: the Bank's own site is the only plausible primary source for them and it was unreachable behind a bot challenge on every attempt.

As of .

Age gating law

Iran has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.

The Electronic Commerce Law of 2003 touches minors only at the margin and only by delegation: Article 57 states that advertisement and marketing directed at children and young people under the legal age is subject to regulations to be stated in Article 79 of the Law, and no implementing Article 79 regulation establishing an age-verification or age-gating standard has been located.

Article 35 requires that information given to a consumer in a distance transaction be presented with due regard to good faith, citing special measures for the disabled and for children as an example, again without a verification or access-gating mechanism. Neither provision reaches adult content, a social media platform, an app store, or the general design of a service.

As of .

Case law

  • No current case law for Iran AI law
  • No current case law for Iran privacy law
  • No current case law for Iran scraping law
  • No current case law for Iran cybersecurity law
  • No current case law for Iran communications law
  • No current case law for Iran content moderation law
  • No current case law for Iran product and AI liability law
  • No current case law for Iran digital accessibility law
  • No current case law for Iran age gating law
  • No current case law for Iran reuse law
Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

This page covers the instruments LexLint has researched to a stage. Instruments named in the law library but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.