My company works in Iraq. What does the law ask of us when an AI agent reads our data?

The law that applies

I found no comprehensive personal data protection law in force in Iraq as of October 2026. No single law sets the bases for processing personal data, the rights of the people it concerns, or rules for sending it abroad. What exists is a set of narrower texts.

• The Constitution. The 2005 Constitution says every individual has the right to personal privacy. It also guarantees the freedom of communication and correspondence, including electronic communication.
• The Electronic Signature and Electronic Transactions Law No. 78 of 2012. It was published in the Iraqi Gazette, issue 4256, on 5 November 2012. It gives a legal frame for electronic transactions between people and companies. It does not cover personal status matters.
• Instructions under that law. In May 2025 the Ministry of Communications issued Instructions No. 1 of 2025 to facilitate implementing the law, published in the Iraqi Gazette, issue 4826.

Can the agent read personal data at all?

No general Iraqi law answers this question. The Constitution’s privacy right applies to everyone, but it does not set rules for how a company may process data.

The Electronic Signature and Electronic Transactions Law has one narrow rule. Signature data, electronic means and information submitted to the certification authority are confidential, and whoever receives them or reaches them through their work may not disclose them to others or use them for any purpose other than the one they were provided for.

The model provider, and data sent abroad

I found no general rule on sending personal data outside Iraq. Two sector rules do restrict where data is kept:

• The Central Bank of Iraq decided in April 2018 that the processing and storage of electronic payment data must take place inside Iraq.
• The 2025 instructions require licensed providers of electronic signature services to keep a system that protects the confidentiality of their services and of users’ data. They also name where user data and certificates are kept: in the data centres of the Ministry of Communications, or in the National Data Centre after the approval of the General Company for Communications and Informatics, the state company the instructions name.

When something goes wrong

I found no general duty to report a data breach to a regulator or to the people affected. The Electronic Signature and Electronic Transactions Law sets the confidentiality duty above, but I found no specific penalty in it for disclosing data.

What Iraq says about AI itself

I found no Iraqi law on AI, and no officially published national AI strategy, as of October 2026.

Sector rules

• Electronic payments. Payment data must be processed and stored inside Iraq, under the Central Bank’s 2018 decision.
• Electronic signature services. Licensed providers must protect users’ data and keep it in the data centres the 2025 instructions name.

What this means for you

• Do not assume there is no rule. Check your sector first, especially payments and banking, before the agent sends data abroad.
• Treat the constitutional right to privacy as the floor, and set your own rules for what the agent may read.
• If you operate in more than one country, apply the stricter law of the other country to your Iraqi data where you can.
• Watch for a data protection law. When one is passed, its rules may reach systems you build now.

I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.

References

1. WIPO Lex, Constitution of the Republic of Iraq, 2005
2. Iraqi Ministry of Justice, Iraqi Gazette, Law No. 78 of 2012, The Law of Electronic Signatures and Transactions, English translation
3. Iraqi Ministry of Justice, Iraqi Gazette issue 4826, Instructions No. 1 of 2025
4. Central Bank of Iraq, Decision that electronic payment data be kept and processed inside Iraq, April 2018

Hesham Elmahdy, Published 28 October 2026