Iraq

The Commission works from a framework regulation for digital platforms and services. The draft went out for public consultation in November and December 2024, and by August 2026 the Commission was citing that framework as the basis for approving a foreign platform. A further annex, a regulation requiring smartphone applications to be registered in Iraq, was still out for consultation in June 2026 and is therefore only a proposal. The Commission also polices the other direction: in August 2026 it warned publicly that nobody is an authorised agent for the satellite service Starlink in Iraq and that people claiming otherwise face legal action.

Sector by sector, checked 18 August 2026. BANKING: conditional. The banking law imposes customer secrecy with listed exceptions, so an offshore cloud arrangement is a secrecy question rather than a transfer question. PAYMENTS: unknown. The central bank licenses payment companies and publishes lists of them, but its instructions library could not be opened by an automated reader, so we cannot confirm or deny a storage rule; treat this as the biggest open risk. SECURITIES: open. We read the securities regulator's rules on internet-based trading and they require reliable infrastructure and data security but say nothing about where systems or data sit. INSURANCE: no rule found; the insurance supervisor publishes no instructions online. TELECOM: conditional, through licence conditions and regulator orders rather than a published data law. SATELLITE BROADBAND: a copy must stay, in effect, because sign-up and ground infrastructure must be in Iraq. GOVERNMENT: unknown; the national e-services portal publishes a privacy policy link but the text could not be read. HEALTH, EDUCATION, GAMING, MAPPING and DEFENCE: no data location rules found on official sources.

Because there is no transfer regime, the practical safeguards are commercial and sectoral. For a bank, the question is whether the customer consented or whether one of the banking law's exceptions applies, since secrecy binds the bank no matter which country the server is in. For money-laundering purposes, the financial intelligence unit may share information with foreign counterparts, but the receiving body must keep it confidential, may use it only for money laundering, terrorist financing and related offences, and needs the originating authority's permission before passing it on. For a licensed communications or satellite operator, the licence and the regulator's orders are the binding instrument.

The distinction matters when you are sizing risk. There is no regulator that will audit your privacy notice, your consent flows or your international transfers, because no law creates those duties. There is a regulator that can suspend your sales channel, cancel your contract or refuse to approve your app, and it did all three kinds of thing in 2026. A National Cybersecurity Centre also exists and ran a national cyber exercise in January 2026 with the prime minister's sponsorship, but we could not find its own website or any published rules it issues, so we cannot say it supervises anyone.

The five-year duty sits in the money-laundering and terrorist-financing law and applies to financial institutions and to designated non-financial businesses and professions. Tax and company-law retention periods almost certainly exist in Iraq as well, but we could not open an official text stating them, so they are listed as unconfirmed rather than asserted. There is no published rule requiring these records to be stored inside Iraq; the duty is to have them and produce them.

This is a genuine gap rather than a light-touch regime: with no breach law, no regulator and no published deadlines, the exposure after an incident is contractual, reputational and, for licensed firms, supervisory. The communications regulator has shown it will act on the misuse of subscriber records, which is the closest thing to an incident response you should plan for. Expect any future breach duty to arrive through licence conditions or a regulator circular rather than through a statute, because that is how the other digital rules have arrived.

A fifth item to keep on the list: the Kurdistan Region runs its own institutions and its own digital transformation programme, and the communications regulator's August 2026 order was aimed specifically at agents in the Kurdistan governorates. Assume regional practice can differ from Baghdad and check locally. Note also that the absence of a privacy law does not mean the absence of criminal exposure; it means the exposure is scattered across instruments we could not all verify from official texts, which is itself a reason for caution.

Dormant switches matter more here than pending legislation, because the communications regulator already holds the powers it needs. It can approve or refuse a foreign platform under its framework regulation, add annexes to that framework, write conditions into licences, suspend a sales channel overnight, and terminate an operator's contract, all of which it did between 2025 and August 2026 without new legislation. The regulator also consulted on a cybersecurity regulation in October 2024 and adopted regulations for value-added services and for electronic games; any of these can be extended to cover data handling without a public bill.