Digital Government, Interoperability and Open Government Data Law

This Law is titled the 'Digital Government, Interoperability and Open Government Data Law'. It establishes the general legal framework for public bodies' digital transformation, digital government services, system and registry connections, data exchange and publication of open government data, without prejudice to laws on personal data protection, cybersecurity, digital identity, electronic signatures and transactions, and access to information.

This Law aims to: First—make government services simpler, more consistent and accessible. Second—move from digitalizing paper forms and procedures to redesigning processes from the ground up. Third—prevent repeated requests for data or documents lawfully held by a public body and eligible for exchange. Fourth—establish binding legal, organizational, semantic and technical interoperability rules. Fifth—support data-informed decisions while protecting rights and freedoms. Sixth—make unrestricted government data available for use and reuse in open, machine-readable formats. Seventh—reduce duplicate spending on government systems and platforms and strengthen reusable shared digital components. Eighth—ensure continuity of in-person and assisted channels for people unable to use digital ones.

For this Law: 1. 'Public body' means any ministry, entity not affiliated with a ministry, independent body, governorate, administrative unit, public enterprise or publicly funded institution insofar as it performs a public function. 2. 'Digital government service' means a public service that can be requested, completed or tracked wholly or partly electronically. 3. 'Interoperability' means bodies' and systems' ability to exchange, understand and use data and information in a coordinated manner under common legal, organizational, semantic and technical requirements. 4. 'Base registry' means an approved government register serving as the authoritative source for a defined data category. 5. 'Reference data' means common values, codes or classifications used by more than one body. 6. 'Application programming interface' means a documented technical means of controlled automated exchange between systems. 7. 'Open government data' means legally unrestricted data published by a public body in an accessible, usable and reusable format. 8. 'Open licence' means standard legal terms permitting use, reuse, modification and distribution with the minimum necessary restrictions. 9. 'Shared government digital infrastructure' means common national components such as service portals, government connections, notification, payment, verification and exchange services, and government cloud or hosting, under applicable laws. 10. 'Centre' means the National Centre for Digital Transformation in the Prime Minister's Office or its lawful successor. 11. 'National catalogue' means a central register of services, data, registries, integration interfaces and approved standards.

First—This Law applies when public bodies design, procure, operate or develop a digital service, information system, register, platform or data integration, or publish open government data. Second—Relevant technical and contractual obligations apply to contractors and service providers insofar as they work for public bodies. Third—This Law does not apply to classified operational activities of armed forces, security or intelligence bodies to the extent secrecy is legally necessary; security, accountability, recordkeeping and proportionality requirements under special laws remain. Fourth—The Law does not prejudice Kurdistan Region and local authorities' constitutional powers; federal integration with them rests on constitutional jurisdiction and lawful technical and legal agreements.

Public bodies shall observe: user-centred services; digital by design rather than later addition; once-only provision where data exchange is lawful; data minimization; compatibility and portability; technology neutrality; security and privacy by design; accessibility for persons with disabilities; transparency and auditability; continuity and resilience; reuse of shared components; openness and open standards where appropriate; and no exclusion of those unable to use digital channels.

A public body may not require a paper copy of a document or information where it has lawful, secure access to the authoritative government source, unless digital verification is unavailable, a special law requires the original, or a justified evidential need exists. Recurrent exceptions must be documented and the underlying technical or legal cause addressed.

First—A person shall not be asked to provide the same data repeatedly to different public bodies where it exists in a base registry and can lawfully be shared. Second—This principle is not a general authorization for data exchange; exchange requires a lawful purpose and the legal basis and limits prescribed by the Personal Data Protection and Digital Privacy Law and other applicable laws. Third—Where possible, users must be able to identify the source of data used for their service and correct errors through the competent body.

Electronically completed applications, notices, decisions, records and correspondence have legal effect when they meet this Law and laws governing electronic transactions, digital identity and trust services. A transaction may not be refused merely because it is electronic where approved legal and technical requirements are met.

First—The state shall adopt a unified national government services portal, with 'Ur' serving as the national gateway unless a law or the Council of Ministers designates a successor. Second—Public bodies may provide specialized channels integrated with the portal and its standards without unnecessary parallel identities or accounts. Third—The portal shall publish service descriptions, conditions, fees, completion times, steps, responsible authorities and grievance or complaint channels, and allow application tracking where the service permits.

The Centre shall establish a mandatory national catalogue for all public services, recording the service owner, legal basis, beneficiaries, inputs, outputs, fees, timeframe, channels, digitalization level, connected systems and registries, and usage and quality indicators. No new digitalization project for a listed service may begin before its procedures are reviewed and duplicate requirements or requirements lacking legal grounds are removed.

On the Centre's proposal, the Council of Ministers shall issue a national digital service standard defining minimum requirements for user experience, accessibility, language, account management, notifications, journey documentation, usability testing, performance measurement, outage management, support and recordkeeping. Compliance is required for approval of new national services or substantial renewals.

First—Public bodies shall provide suitable assisted channels for people unable to use digital self-service because of disability, limited digital literacy, poor connectivity or other legitimate reasons. Second—No additional fee may be imposed merely for assistance in using a digital government service. Third—In-person centres may be consolidated into unified service centres provided actual access is not reduced.

Government websites, applications and services must observe recognized international digital accessibility standards for persons with disabilities, provide suitable text and functional alternatives, and undergo periodic testing with users of diverse needs. The Centre shall coordinate with competent bodies to issue binding digital accessibility guidance.

First—A 'Government Digital Governance Council' shall be established, chaired by the Prime Minister or a delegate and comprising senior representatives of relevant bodies, to approve national policies and common standards and resolve cross-ministerial conflicts. Second—The Centre shall serve as technical secretariat, prepare standards, monitor implementation and operate or manage shared national components designated by the Council of Ministers. Third—Ministries' and bodies' substantive powers over their records and services do not transfer to the Council or Centre except by law.

Each public body shall appoint a digital transformation officer with appropriate rank and powers, responsible for the map of systems, services and data, national standards compliance, avoiding duplication and coordinating with cybersecurity, data protection, procurement and internal audit officers.

The Centre shall adopt a national enterprise architecture framework defining layers, roles and reference standards for processes, data, applications and technology. Each body must update its map of systems, dependencies, interfaces and data sources before a major digital project is approved.

First—The Council of Ministers shall issue a national interoperability framework on the Centre's proposal. Second—It shall cover legal, organizational, semantic and technical interoperability and define common data models, national codes, exchange standards, documentation, version management, backward compatibility and integration-interface availability. Third—Compliance is a condition for funding or procuring a new government system requiring interaction with other bodies.

Before approving a major project or change affecting data exchange or shared service delivery, the body shall assess interoperability, identifying affected systems and bodies, legal and organizational constraints, reusable national standards or components, lock-in risks, and security and privacy effects. A summary shall be lodged with the Centre.

First—A reasoned Council of Ministers decision shall designate national base registries, their legal owners and scope. A parallel base registry for the same data category is prohibited except by law or temporary technical necessity with an integration plan. Second—The registry owner is responsible for data quality, updating, documenting its dictionary and providing lawful verification or exchange. Third—Designation as a base registry does not expand permissible data uses beyond their legal basis.

Working with competent bodies, the Centre shall adopt a national dictionary of reference data, common codes and classifications, including identifiers for bodies, administrative units, addresses, services, documents and procedural statuses. Conflicting codes in new systems are prohibited except for a documented sectoral need with a clear mapping mechanism.

The state shall establish or adopt secure infrastructure for exchange among public bodies, without necessarily creating a central data store. The default is minimal data exchange through documented, auditable interfaces specifying the requesting body, purpose, legal basis, data type, access duration, access logs and revocation controls.

Bodies managing integrable systems shall provide documented, secure APIs where exchange is legally required and technically feasible. Documentation must include field specifications, validation rules, request rates, error handling, service levels, change and version policies, and pre-production testing.

General sharing rules or permanent bulk copies of another body's data may not be created merely for easier access without a legal basis and demonstrated operational need. Targeted queries, real-time verification or exchange of necessary attributes should be preferred to entire database copies wherever possible.

Shared systems and base registries shall retain sufficient technical logs to identify who requested data, when, for which service or purpose and the result, without unnecessary content. Logs shall be protected against tampering and made available to competent audit and oversight bodies under the law.

The state shall designate shared digital components for public-sector reuse where they meet the need, including as laws and policies determine: the national portal, verification and identity, notifications, payments, data exchange, digital correspondence, signatures and trust services, reference maps and addresses, government hosting and monitoring tools. A body may create a parallel component only after demonstrating that the national component is unsuitable or unavailable.

The Council of Ministers shall establish a classification and hosting policy defining which systems and data may be hosted in government infrastructure or public, private or hybrid clouds, according to sensitivity, sovereignty, security, continuity and cost. Server location alone is not sufficient to determine security or sovereignty; legal control, encryption, key management, supply chains and portability must be assessed.

Government system contracts shall establish clear state rights to access and export its data in standard formats and obtain documentation, interfaces, schemas and configuration components needed for continuity. Terms effectively withholding data or obstructing service migration to another provider without a legitimate technical justification are prohibited.

Where solutions are equivalent in functionality, security, total cost and maintainability, bodies shall prefer open-standard or reusable solutions. Open-source software may be preferred where it reduces lock-in and enables audit and reuse. Openness does not replace security, support or contractual responsibility requirements.

No major government system contract may be concluded before reviewing compatibility with the national catalogue, enterprise architecture, interoperability framework, and security, privacy and portability requirements. Procurement documents must include measurable acceptance criteria, documentation, testing and audit rights, service levels, and an exit and transition plan.

Where identity or status verification is needed, government services shall integrate with the national digital identity and trust-services system under the relevant legislation. Bodies shall not maintain separate sensitive credential stores where an approved national service meets the purpose. Staff and system accounts shall apply least privilege and separation of duties.

Where a fee or service charge is imposed by law, the digital service must offer approved electronic payment methods where infrastructure is available and issue a verifiable receipt linked to the transaction without disclosing unnecessary financial data. Applicable Central Bank, financial and accounting rules shall be respected.

Government notices may be sent electronically where a reliable means of proving dispatch or receipt exists according to the procedure and its governing law. Judicial or administrative service with serious legal consequences is not presumed merely from an ordinary message unless special service requirements are met. Users must be able to manage non-mandatory communication channels.

Bodies shall manage digital records throughout their lifecycle from creation to retention or destruction, ensuring authenticity, integrity, searchability, auditability and portability. The competent national archival authority shall coordinate with the Centre on long-term preservation, formats, signatures and timestamps.

Each body shall identify critical digital services, required continuity levels, outage and disaster recovery plans, recovery points and acceptable downtime, and test them periodically with competent cybersecurity and disaster-risk bodies. Reliance on a single centre or supplier is prohibited where it creates an unacceptable single point of failure.

Services must be designed and operated with cybersecurity and personal data protection requirements from the outset, including risk and impact assessments required by relevant laws. This Law does not authorize additional data collection for service improvement or analytics without a defined lawful purpose.

The data-owning body shall establish rules for quality, completeness, accuracy, timeliness and consistency, and error correction and reporting mechanisms. Inter-agency sharing must not spread a known error or make it a permanent reference without a correction route.

The Council of Ministers shall issue a national policy defining responsibilities for administrative ownership, quality, classification, catalogues, access, sharing, retention and publication, clearly distinguishing an agency's ownership of a registry from individuals' legal rights in their personal data or third parties' intellectual property rights.

Unrestricted government data shall be candidates for open publication by default, subject to prior legal, rights and security review. Openness excludes personal, confidential, classified or legally non-disclosable data and does not replace individual information-request procedures under access-to-information law.

Publication shall be withheld or restricted as necessary where it would unlawfully expose personal data; harm national security, defence or public safety; breach investigation or judicial confidentiality; reveal legitimate trade secrets or intellectual property the state cannot license; threaten critical infrastructure; or breach another legal prohibition. Exceptions must not conceal data merely because it could expose administrative failings or invite criticism.

The state shall continue operating a national open government data portal, with technical coordination by the Centre or another body designated by the Council of Ministers. Each body shall publish open data through the portal or connect its repository so it is searchable and accessible from one national point.

Open data shall use machine-readable and, where possible, non-proprietary formats, with metadata identifying the body, source, coverage, update frequency, last update, field definitions, data quality, licence and contact method. Publishing an image-based PDF of structured tables does not fully meet open-data obligations where the structured original can be published.

Open government data shall carry a national open licence permitting copying, analysis, combination, redistribution and commercial and non-commercial use, requiring source attribution where appropriate and no implication of government endorsement of derived products. Additional conditions are permitted only where authorized by law, necessary and proportionate.

Open data shall normally be free. Actual marginal costs for special delivery or a value-added service outside basic publication may be charged under a published scheme. Fees may not prevent reuse or protect a public body's information monopoly.

Following public consultation, the Council of Ministers shall identify data categories of high economic, social, environmental or research value and prioritize their quality, updating and automated access. Subject to legal restrictions, they may include maps, administrative boundaries, budgets, expenditure, contracts, transport, environment, energy, statistics and non-personal economic registers.

For high-demand or rapidly changing datasets, the body shall publish an API or suitable regular download channel, with reasonable usage limits protecting stability and security. Material changes to data structure or discontinuation of an interface shall be announced with appropriate notice wherever possible.

The national portal shall provide a mechanism to propose new datasets or improvements. The owner must respond with publication, a reasonable publication timetable, or legal or technical reasons for not publishing. Non-sensitive requests and responses shall be published to support accountability and prioritization.

Before publishing de-identified or aggregate data, the body shall assess the risk of re-identifying individuals through reasonably available data and apply appropriate aggregation, masking or perturbation where necessary. Data may not be described as 'anonymous' where practically linkable to individuals at an unacceptable risk level.

Bodies shall periodically publish non-personal performance indicators for major digital services, including usage, actual completion time, completion rates, outages, complaints, availability and user satisfaction where measured. Promotional figures may not be published without defining the measurement method.

For major transformation projects, the body shall establish a baseline covering current costs, expected capital and operating costs, measurable benefits, implementation risks, and replacement and maintenance costs. Reduced paper use alone is insufficient justification for a project that neither redesigns procedures nor delivers a clear public benefit.

Implementation is subject to the Federal Board of Supreme Audit and competent oversight and judicial bodies, each within its remit. The Centre may assess technical and organizational compliance and issue binding corrective plans for common standards after approval by the Government Digital Governance Council, without replacing statutory oversight bodies' authority.

Each major government digital project must have a named executive owner, scope, budget, timetable, success indicators, risk plan and exit plan. It shall report periodically to the funding body and Centre and be stopped or redesigned if persistent material failure or rising costs without proportionate benefit are established.

Subject to legitimate commercial and security secrets, bodies shall publish basic information on major government digital contracts: project name, body, contractor, value, duration, purpose and delivery indicators. General specifications and standards whose disclosure does not harm security may be published to strengthen competition and reuse.

Where public bodies dispute responsibility for a registry, standard, integration or data sharing, the Centre shall seek a technical and legal resolution within a reasonable time. Disputes over statutory or constitutional powers beyond its authority shall go to the Council of Ministers or competent judicial or constitutional body as appropriate.

A digital channel does not prevent statutory grievances, appeals or complaints. Services issuing individual decisions must identify the decision-making body, legal basis and challenge mechanism; user interfaces or automation must not obstruct exercise of rights.

Where a public body uses an automated or AI system to assess, rank or decide a matter affecting a right or legal status, AI governance and algorithmic accountability provisions apply, including transparency, documentation and human review required by the relevant law. This Law itself provides no legal basis for using AI in decision-making.

Public bodies may cooperate with companies, universities and civil society on digital government and open-data solutions within competition, procurement, data protection, security and intellectual property rules. Sovereign powers, administrative decisions and government data remain subject to law and public oversight.

Bodies shall maintain programmes developing staff skills in service design, data, enterprise architecture, security, privacy, digital procurement and product and project management. Specialist public-service career paths may attract digital expertise under civil service law and applicable regulations.

Time-limited test environments or pilots may trial a service, standard or technology before wider adoption, provided scope, users, risks, rights and data protection, and termination plans are defined. Experimentation may not suspend a law or bypass a judicial requirement or constitutional right.

The Centre shall submit a public annual report to the Council of Ministers and Council of Representatives on digital transformation, interoperability and open data, with verifiable indicators, shared-component status, agencies' compliance, stalled projects and legislative and funding obstacles. It shall be published except for legally protected material.

Obligations under this Law shall be funded within public and investment budget appropriations and other lawful resources. Priority goes to reusing existing infrastructure and systems and consolidating duplication before new platforms are created. This Law creates no specific capital expenditure commitment unless duly included in the budget.

Within twelve months of entry into force, each body shall inventory its systems, services, databases and technology contracts, identify what to retain, merge, update or discontinue, and identify systems lacking interfaces, documentation, portability or adequate access controls.

First—The interoperability framework, service standard and data governance policy shall be issued within twelve months of publication. Second—New projects shall comply when the standards take effect; existing systems receive up to twenty-four months for alignment according to risk and cost. Third—Priority goes to base registries, high-demand services and integrations eliminating repeated document submission.

Within eighteen months of entry into force, the Council of Ministers shall submit amendments aligning laws, regulations and instructions that require only paper, physical presence or traditional stamps where safe and lawful digital alternatives exist, preserving special evidential requirements and substantive safeguards. This package shall be coordinated with data protection, digital identity, trust services, cybersecurity, telecommunications, administrative procedure and public procurement laws.

The Council of Ministers shall issue implementing regulations. The Centre shall issue technical and organizational standards and guidance within its remit after consulting affected bodies and publishing final versions. A technical standard may not create an obligation affecting a right or expand data-collection powers without legislative authority.

This Law creates no new technology offences. Applicable laws govern embezzlement, forgery, unlawful access, record tampering and abuse of office. Staff are disciplinarily accountable for deliberately bypassing access controls, obstructing lawful interoperability, concealing project failure or repeatedly requesting prohibited documents after warning, under state employee disciplinary law and relevant legislation.

First—Personal data protection, cybersecurity, digital identity, trust services, telecommunications, access to information, procurement and archiving rules apply in their respective fields. Second—A specific provision prevails over a general one within its scope, but this Law must not diminish constitutional privacy, communications confidentiality, appeal rights or judicial safeguards. Third—Open data is not synonymous with publishable personal data.

Any lower-ranking provision conflicting with this Law is repealed from the effective date of the competent legal instrument repealing or amending it. This provision does not authorize administrative repeal of an applicable law.

This Law shall be published in the Official Gazette and take effect six months after publication. Provisions establishing the Government Digital Governance Council and preparing frameworks and standards apply from publication for preparatory purposes.