Iraq

The Commission works from a set of rules for digital platforms and services. The draft went out for public consultation in November and December 2024. By August 2026 the Commission was citing those rules as the basis for approving a foreign platform. There is a further part, a rule requiring smartphone applications to be registered in Iraq. It was still out for consultation in June 2026, so it is only a proposal. The Commission also polices the other direction. In August 2026 it warned publicly that nobody is an authorised agent for the satellite service Starlink in Iraq. It said people claiming otherwise face legal action.

Here is each industry, checked 18 August 2026. BANKING: conditional. The banking law makes banks keep customer information secret, with listed exceptions. So using an overseas cloud is a secrecy question, not a transfer question. PAYMENTS: unknown. The central bank licenses payment companies and publishes lists of them. We could not open its library of instructions with an automated reader. So we can neither confirm nor rule out a storage rule. Treat this as the biggest open risk. SECURITIES: open. We read the securities regulator's rules on internet-based trading. They require reliable infrastructure and data security. They say nothing about where systems or data sit. INSURANCE: we found no rule. The insurance supervisor publishes no instructions online. TELECOM: conditional, through licence conditions and regulator orders rather than a published data law. SATELLITE BROADBAND: a copy has to stay in Iraq, because sign-up and ground infrastructure must be in Iraq. GOVERNMENT: unknown. The national e-services portal links to a privacy policy, but we could not read the text. HEALTH, EDUCATION, GAMING, MAPPING and DEFENCE: we found no rules about where data must sit on official sources.

There are no transfer rules, so the safeguards that matter are commercial and industry-specific. For a bank, the question is whether the customer consented, or whether one of the banking law's exceptions applies. Secrecy binds the bank whichever country the server is in. For money-laundering purposes, the financial intelligence unit may share information with foreign counterparts. The receiving body must keep it confidential. It may use it only for money laundering, terrorist financing and related offences. It needs permission from the Iraqi authority before passing it on. For a licensed communications or satellite operator, the licence and the regulator's orders are what bind you.

This difference matters when you size up your risk. No regulator will audit your privacy notice, your consent flows or your international transfers. No law creates those duties. But a regulator can suspend your sales channel, cancel your contract or refuse to approve your app. It did all three kinds of thing in 2026. A National Cybersecurity Centre also exists. It ran a national cyber exercise in January 2026, sponsored by the prime minister. We could not find its own website or any rules it publishes. So we cannot say that it supervises anyone.

The five-year duty sits in the money-laundering and terrorist-financing law. It applies to financial institutions, and to named non-financial businesses and professions. Tax and company-law keeping periods almost certainly exist in Iraq too. We could not open an official text stating them, so we list them as unconfirmed rather than state them. There is no published rule requiring these records to be stored inside Iraq. The duty is to have them and to produce them.

This is a real gap, not a light touch. There is no breach law, no regulator and no published deadlines. So after an incident your exposure is to your contracts, to your reputation and, if you are licensed, to your regulator. The communications regulator has shown it will act on misuse of subscriber records. That is the closest thing to an incident response you should plan for. Expect any future breach duty to arrive through licence conditions or a regulator circular rather than through a law. That is how the other digital rules have arrived.

A fifth item to keep on the list. The Kurdistan Region runs its own institutions and its own digital transformation programme. The communications regulator's August 2026 order was aimed specifically at agents in the Kurdistan governorates. Assume regional practice can differ from Baghdad, and check locally. Also note this. No privacy law does not mean no criminal risk. It means the risk is scattered across many laws, and we could not verify all of them from official texts. That alone is a reason for caution.

Changes the regulator can make alone matter more here than new laws. The communications regulator already holds the powers it needs. It can approve or refuse a foreign platform under its digital platform rules. It can add further parts to those rules. It can write conditions into licences. It can suspend a sales channel overnight. It can end an operator's contract. It did all of these between 2025 and August 2026 without any new law. The regulator also consulted on a cybersecurity rule in October 2024. It adopted rules for value-added services and for electronic games. Any of these can be extended to cover data handling without a public bill.