Where the law stands
Iraq does not have one comprehensive data protection law at the moment, and a draft is still being discussed. Rules sit in several places: the constitution’s privacy guarantees, the penal code, telecom regulation by the Communications and Media Commission, and the electronic transactions law. Contracts with customers and with international partners often ask for more.
Collect less
Ask only for the details you need. A contact form needs a name and a way to reply, not an ID number or a home address.
- Say why you collect each field
- Keep forms short and in the customer’s language
- Delete old enquiries on a schedule
Protect what you keep
Use HTTPS everywhere, strong admin logins with two-step verification, regular updates and encrypted backups stored away from the web server. Limit who can see customer data, and remove accounts when staff leave.
Be open with visitors
Publish a short privacy notice in Arabic, Kurdish and English that says what you collect, why, how long you keep it and who to contact. Ask for consent before non-essential cookies.
Prepare for incidents
Know who decides what if data leaks: who fixes it, who informs customers and how fast. A one-page plan written now saves hours later.