Status
Bill pending
Consent model
None
Primary law
Personal Data Protection and Safeguarding Bill (pending); e-commerce law has limited data rules
Year
n/a
Authority
None yet
Marketing consent
No comprehensive consent requirement; e-commerce law imposes narrow duties on online sellers.
Transfers
Cross-border data flows run through a state-controlled network environment.
Penalties
Only sector-specific penalties apply.
The framework
Iran has no comprehensive data protection law in force yet.
Absent a local rule, the practical constraints come from platform policies and foreign laws with extraterritorial reach.
Marketing and advertising
No comprehensive consent requirement; e-commerce law imposes narrow duties on online sellers. With no operative local consent rule, the practical guardrails are platform policy and any foreign law that can reach the campaign.
Cross-border transfers
Cross-border data flows run through a state-controlled network environment.
Enforcement and penalties
Only sector-specific penalties apply.
Cite this page: "Iran Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/iran.html. Accessed [date].