Law / Iran

Iran

4 of 11 named instruments researched to a stage, across three of the six areas of law we track: 4 in force. As of 19 September 2026.

AI law none researched
Privacy law 1
Scraping law 2
Cybersecurity law none researched
Age gating law none researched
News aggregation law 1

in forceenacted but not yet in forceproposedrepealed, withdrawn or blocked

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Privacy law1 instrument, 1 in force

Research summary (197 words)

Iran has no comprehensive personal-data-protection law. The closest thing is a limited chapter of the Electronic Commerce Law of 2003, Articles 58 to 61, read in full from an official WIPO Lex-hosted text (72,766 characters, not truncated); a citation of the personal-data chapter as "Arts. 58-63" is wrong, since it sweeps in Articles 62-63, the Act's separate copyright chapter.

A broader "Protection of Personal Data" bill has been under Majlis review since approximately 2018 and remains unenacted as of a fresh check; no citable primary bill text was located, so it is not authored here.

Biometrics, cross-border transfer, and breach notification are confirmed absent from the full chapter rather than merely unresearched: Article 58's sensitive-category list (tribal or ethnic origin, religious or moral belief, ethical characteristics, physical, psychological, or sexual condition) names no biometric category, and the chapter contains no cross-border-transfer provision and no security-incident notification duty (the only "breach" heading found is the criminal-offense section title, meaning violation of the law, not a notification duty).

Iran also operates a mandatory biometric national identity card program, but no citable statute or regulation establishing it is located; that is recorded as a checked-and-not-found gap, not an authored instrument.

Sensitive categories

Electronic Commerce Law (2003), Personal Data Chapter

Electronic Commerce Law, approved by the Islamic Consultative Assembly, 2003, Arts. 58-61 (personal-data chapter)Electronic Commerce Law official text hosted by WIPO Lex, a UN-agency legal database republishing verbatim government-supplied texts

In force since 1 January 2004. Binds private bodies.

What this law does

Article 58 requires explicit consent before storing, processing, or distributing data revealing tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition; this is Iran's complete sensitive-category list and it names no biometric category.

Article 59 sets a general consent-based processing standard (specified purpose, data minimization, accuracy) and gives the data subject access to their own files with a right to correct or completely remove them. Article 60 defers medical and health-record data to separate, unlocated regulations, and Article 61 defers exceptions and "supervision and control" to other chapters without spelling out a dedicated regulator.

Enforcement is criminal only, one to three years' imprisonment under Article 71 (enhanced for institutional offenders under Article 72), with no described administrative penalty scheme and no private right of action found. No cross-border-transfer provision and no breach-notification duty were found anywhere in the chapter.

What it requires

Scraping law2 instruments, 2 in force

Research summary (345 words)

Iran has no scraping-specific statute, so general law governs each dimension separately, and the record is thin: only two of the seven registered families are grounded in a citable official text.

Open-web crawling of a public page and computer-misuse law are governed by the Computer Crimes Law (Law No. 71,063 of 2009), which secondary sources (Stanford's World Intermediary Liability Map, an ARTICLE 19 legal analysis) describe as criminalising unauthorised access to a computer or telecommunications system; no official gazette or government-portal text of that Law has been located, only the intermediary-liability commentary on its content-filtering articles, so no instrument is authored on it here and the unauthorised-access provision's exact terms remain unverified against a citable primary source.

No Iranian court decision on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper was located.

The Electronic Commerce Law of 2003 extends the closed, no-text-and-data-mining quotation exception of the Act on Protection of Authors, Composers and Artists Rights, 1970 (recorded under the aggregation topic for this jurisdiction) to works transmitted as electronic data messages, while separately exempting a temporary, inevitable copy made in the course of network data-message processing; that Law confers no sui generis database right, listing 'protection of databases' only as one of several intellectual-property regimes a data message may fall under without creating a distinct right, and its related-rights coverage does not extend beyond authors, composers and artists.

The same Law's trade-secrets sections protect a business's confidential electronic information against illegal acquisition or disclosure in order to protect legitimate and fair competition, which is Iran's closest analogue to an unfair-competition or misappropriation doctrine reaching scraped proprietary data.

Personal data scraped from a public Iranian website is reached by the Electronic Commerce Law's personal-data chapter (Arts. 58-61), landed under the privacy topic for this jurisdiction; that chapter's duty attaches to the data itself rather than to the act of collection, so it is not restated as a scraping instrument here. No Iranian statute or reported case assigns legal weight to a robots.txt directive or states an AI-training-specific rule beyond the temporary-copy exception below.

Copyright and text and data mining (TDM)

Electronic Commerce Law, Copyright in Digital Works Chapter

Electronic Commerce Law (2003), Arts. 62-63 (copyright in digital works) and Art. 74 (penalty)Electronic Commerce Law official text, WIPO Lex

In force since 24 October 2003. Binds public and private bodies.

What this law does

Article 62 extends the copyright regime of the Act on Protection of Authors, Composers and Artists Rights (1970), the 1976 translation-and-reproduction law and the 2000 computer-software-producers law to a work in the form of an electronic 'data message', so the right to copy, perform, distribute, supply and publish such a work belongs exclusively to the author.

Article 63 exempts a temporary act of copying, performing or distributing a work where that act is an inevitable part of processing the data message on a network, a caching-style exception that is not conditioned on the copy being made for training or for any other stated purpose. Article 74 makes violating the copyright chapter an offence carrying corrective imprisonment of three months to one year or a fine of up to 50,000,000 Rials.

Neither Article 62 nor Article 63 states a text-and-data-mining-specific rule or an AI-training carve-out; the underlying 1970 Act's own quotation exception (Art. 7, recorded under the aggregation topic for this jurisdiction) is a closed list that reaches no data-mining purpose. The Electronic Commerce Law entered into force on 24 October 2003.

What it requires

Unfair competition

Electronic Commerce Law, Trade Secrets Chapter

Electronic Commerce Law (2003), Arts. 64-65 (trade secrets) and Art. 75 (penalty)Electronic Commerce Law official text, WIPO Lex

In force since 24 October 2003. Binds public and private bodies.

What this law does

Article 64 makes the illegal acquisition of a trade or economic secret, or its disclosure to a third party in an electronic environment, an offence, stated as protecting legitimate and fair competition in electronic transactions.

Article 65 defines an electronic trade secret broadly to include information, formulas, software and programs, methods, unpublished writings, business and transaction methods, strategies, plans, financial information and customer lists that have economic value, are inaccessible to the public, and for which reasonable protective efforts have been made. Article 75 sentences a violator to corrective imprisonment of six months to two and a half years or a fine of up to 50,000,000 Rials.

No robots.txt-specific or AI-training-specific rule is stated; a scraper's bulk acquisition of a business's non-public electronic data could fall within Article 64 if the data meets Article 65's economic-value and inaccessibility tests.

What it requires

News aggregation law1 instrument, 1 in force

Research summary (165 words)

Iran has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Act on Protection of Authors, Composers and Artists Rights, 1970 governs an aggregator's reproduction of news content.

Article 7 permits quoting from a published work and referring to it only for a closed list of purposes, literary, scientific, technical or educational purposes, and criticism or praise, with the source named and the customary limitations observed; the list names no general news-reporting or press-summary category and no text-and-data-mining or machine-processing purpose.

No statute or reported Iranian decision addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law was located. The Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.

Neighbouring rights specific to press publishers do not appear in the Act, which is organised around the individual author's rights.

Snippet reproduction

Copyright Act (1970), Quotation Exception

Act on Protection of Authors, Composers and Artists Rights, 1970, Art. 7 (quotation exception)Act on Protection of Authors, Composers and Artists Rights, 1970, official English translation, WIPO Lex

In force. Binds public and private bodies.

What this law does

Article 7 permits quoting from a published work and referring to it, but only for literary, scientific, technical or educational purposes, and in criticism or praise, provided the source of the quotation is named and the customary limitations are observed; a note excuses naming the source only where a teacher reproduces the work for non-commercial classroom use.

The list is closed and names no general news-reporting, press-summary or commentary-on-current-events category distinct from criticism or praise, and no text-and-data-mining or automated-processing purpose.

Article 23 makes publishing, distributing or broadcasting the whole or part of another person's protected work without permission, or under a false attribution, an offence carrying corrective imprisonment of six months to three years, which is the penalty a reproduction falling outside Article 7's closed list would face. The WIPO Lex record gives only the Act's adoption date, 12 January 1970, and no separate entry-into-force date.

Note and primary source

This page covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.