Law: There is no general data protection regulation.

Regulator: There is no general data protection authority.

Summary: Although Iraq has not adopted a comprehensive data protection legislation applicable to private organizations, it has established a law regulating privacy within the public sector. In addition, the right to privacy protection can be found in the Iraqi Constitution (the Constitution) which recognizes the right to privacy as balanced with other people's rights and public morals, and in several pieces of sectoral legislation. In particular, general privacy and confidentiality requirements can be found in legislation applicable to sectors such as financial services, health and pharmaceutical, telecommunications, and labor.

Furthermore, the Iraqi Government has been working on a cybercrime law. Previous efforts towards enacting a draft information crimes law were abandoned in 2013 after encountering difficulties within Iraq and from outside, at least partly due to questions of whether the draft law contravened international standards.