Digital Identity, Trust Services, Electronic Signatures and Transactions Law

This Law shall be called the ‘Digital Identity, Trust Services, Electronic Signatures and Transactions Law’. It establishes a unified, technology-neutral legal framework for proving identity and capacity digitally; giving legal effect to electronic transactions, records, signatures and seals; and regulating trust services, providers, supervision and recognition within Iraq and across borders.

It shall promote trust in the digital economy and public services while preserving constitutional rights, privacy and security. Electronic means shall not become mandatory for individuals except under a specific provision ensuring a reasonable alternative where digital access is unavailable.

For this Law: ‘digital identity’ means data and electronic credentials enabling reliable proof of a natural or legal person’s identity or representative capacity; ‘electronic identification means’, a tangible or intangible tool containing identification data and used for authentication; ‘authentication’, an electronic process verifying a person’s identity or data origin and integrity; and ‘digital identity wallet’, a secure application or means enabling its holder to manage credentials and attributes and present or share them selectively.

‘Trust service’ means an electronic service assuring identity or data origin, integrity, timing, delivery or preservation, including electronic signatures, seals, timestamps, registered electronic delivery, archiving, website authentication, attestations of attributes and other services specified by regulation. A ‘trust service provider’ is a legal person providing such services under this Law. A service is ‘qualified’ if it meets enhanced statutory and regulatory requirements and appears on the national trusted list.

An ‘electronic signature’ is electronic data linked to other data and used by a signatory to sign. An ‘advanced electronic signature’ is uniquely linked to and identifies the signatory, created using means under their control with a high degree of confidence, and linked to data so subsequent changes are detectable. A ‘qualified electronic signature’ is an advanced signature created by a qualified signature-creation device and based on a qualified certificate. An ‘electronic seal’ is created by a legal person to establish data origin and integrity, with analogous levels where applicable.

An ‘electronic record’ is information created, sent, received or stored electronically and accessible for subsequent use. An ‘electronic transaction’ is any legal act, procedure or communication performed wholly or partly electronically. An ‘electronic timestamp’ links other data to a specified time, establishing their existence then. ‘Registered electronic delivery’ transfers data between parties, provides evidence of sending and receipt, and protects against loss or unauthorised alteration. An ‘electronic attestation of attributes’ is authenticated data establishing a fact, right or capacity concerning a person, such as agency, qualification, licence or representative capacity.

This Law rests on technological neutrality, non-discrimination against electronic form, functional equivalence between paper and electronic forms where the required legal function is achieved, proportionality between trust level and transaction risk, interoperability, open standards, privacy and security by design, data minimisation, auditability and avoidance of vendor or technology lock-in.

No provision shall be interpreted to create an unjustified technological monopoly or require a particular technology where another achieves the legally required trust and assurance.

This Law applies to electronic transactions and identity-management and trust services within Iraq, providers established there, and services from abroad regularly targeting persons or entities in Iraq or seeking legal recognition there.

National digital identity provisions apply to federal authorities and matters connected with civil registration, nationality, the national card and federal services, respecting regions’ constitutional powers and coordination and mutual-recognition mechanisms.

This Law does not itself abolish personal attendance, official notarisation or special form required by substantive law for a material reason. Nor does it turn a negotiable document or instrument into an electronic transferable record without legislation establishing specific control, singularity and integrity requirements.

Within existing laws, competent bodies may adopt electronic procedures achieving the same purpose as attendance or notarisation where identity, intent, authority and record integrity can be established to an equivalent or higher level.

No person shall be compelled to accept an electronic transaction with another unless law or contract requires it. Consent may be established by express agreement or conduct leaving no reasonable doubt of acceptance of electronic dealings.

A public body may not refuse an application or instrument merely because it is electronic if it meets this Law and the service’s particular regulations.

A record, message, contract or evidence shall not lose legal effect or admissibility merely because it is electronic. Evidentiary weight shall depend on reliability of creation, preservation, attribution and integrity and all surrounding circumstances.

A statutory writing requirement is satisfied by an electronic record whose information remains intelligibly accessible for subsequent reference, unless a special law expressly prohibits it.

A requirement to present an original may be satisfied electronically where reliable means assure information integrity since first creation and its display on request, considering the document’s nature and the purpose of requiring an original.

A statutory signature requirement may be met electronically through a method identifying the signatory and indicating intent to approve the information, reliable and appropriate to the purpose. A qualified electronic signature has the legal effect of a handwritten signature unless a special law provides otherwise for a constitutional or substantive reason.

An electronic record is sent when it leaves an information system controlled by the originator or representative and received when it enters the recipient’s designated system, or, absent a designated system, when made available for retrieval.

Unless otherwise agreed, sending occurs at the originator’s place of business and receipt at the recipient’s place of business. Server or provider location does not alter this rule.

Electronic acknowledgement of receipt may be required. Where the originator makes the message’s effect conditional on acknowledgement, the agreed effect does not arise beforehand, subject to good faith and prohibition of abuse.

A record is attributable to its originator if sent personally, by an authorised representative or by an information system programmed to act on their behalf. Automation does not prevent contract formation or procedural validity where attribution is possible and legally required error-correction mechanisms are available.

A retention duty is fulfilled by electronic preservation ensuring access, integrity and retention of origin, destination, date and time data where necessary for the statutory period, under archiving and data-protection standards.

Courts or competent bodies shall assess evidentiary value through reliability of creation, transmission and storage, integrity, identification of the originator, use of trust services and other technical evidence. Evidence may not be excluded merely for lacking ‘qualified’ status.

Offer, acceptance and other contractual acts may be expressed electronically. Electronic or automated systems alone do not invalidate a contract; capacity, consent, lawful cause and subject matter, consumer protection and special substantive requirements remain applicable.

Where a person transacts through an automated system lacking a reasonable opportunity to correct a material input error, they may request correction or cancellation without undue delay, provided they have not received an irreversible benefit, without prejudice to special consumer-protection rules.

A national digital identity system shall be established, based for Iraqi natural persons on official national-card and civil-status registers within legal limits, enabling digital verification without copying complete registry data into every relying body.

Digital identity creates no nationality, civil status or new right and does not replace the register establishing an attribute. It is a means of proving identity or capacity electronically to the extent needed for a transaction.

Through its national-card and civil-registry body, the Ministry of Interior shall issue or confirm natural persons’ foundational identity data and securely connect them to the national system. Bodies responsible for legal-person registers shall confirm their identities and representatives’ capacities within their remits.

Accredited public or private bodies may provide identity-management and authentication services, provided they neither create a parallel civil identity nor alter official-register data. They may issue credentials or wallets linked to reliable data at a specified assurance level.

The competent authority shall establish by regulation assurance levels reflecting impersonation risks and consequences of error, with registration, verification, credential issuance, authentication and recovery requirements for each. The highest assurance level may not be imposed on low-risk transactions without justification.

Enrolment shall be proportionate, documented and auditable, using trustworthy sources to verify identity and capacity. Remote enrolment is permitted if approved technical and organisational means, including secure matching, video communication or other regulated methods, provide assurance equivalent to attendance.

Identification means shall be issued only after appropriate verification of identity and capacity and bound to their holder to prevent unauthorised use proportionate to assurance level. Providers shall clearly explain conditions, risks and suspension, revocation and recovery procedures.

Digital identity may connect to separate attestations of agency, employment, membership, licence, qualification or other attributes, sourced from the responsible register or authority. An identity provider may not independently create a legal attribute; its continuing validity shall be checked where necessary.

Identity systems shall, where possible, prove a particular fact without excessive disclosure, such as age, eligibility or capacity without revealing the full record. Relying parties shall request only attributes necessary for their purpose.

The state may approve a national digital identity wallet or multiple compatible means for secure credential and attribute management. Design shall not lock users into one provider or make the wallet the sole condition of essential services where a person cannot use it.

Fast, secure procedures shall address recovery of identity or credentials after device loss, changed contact number, suspected compromise, holder death or loss of capacity. Recovery shall prevent account takeover through independent verification proportionate to assurance level.

The system shall provide reliable and, as far as possible, immediate verification of identification means, certificate or attestation status—valid, suspended or revoked—without exposing information unnecessary to the relying party.

Holders may know which bodies requested identity or attribute verification within legal limits, correct data at their original source, suspend suspected credentials and receive non-discriminatory assistance. Personal Data Protection and Digital Privacy Law provisions apply to all processing.

No person may lose a right or essential service merely for lacking a smartphone, disability, poor connectivity or inability to use a particular means. Assistance and reasonable alternative verification shall be provided, respecting accessibility for persons with disabilities and older persons.

Regulated trust services include electronic signatures, seals, timestamps, registered electronic delivery, trustworthy archiving, website authentication certificates, electronic attestations of attributes, record- or ledger-based services performing a defined trust function, and other services designated by regulation consistently with this Law.

Non-qualified trust services may operate under general rules without claiming qualification. ‘Qualified’ status or the national trust mark may be used only for a service and provider on the national trusted list after conformity and licensing or accreditation requirements are met.

An electronic signature shall not be denied legal effect merely because it is electronic or unqualified. Its effect depends on reliability. Qualified signatures enjoy a rebuttable statutory presumption of attribution to the signatory and integrity of associated data.

A qualified device shall provide high confidence in creation-data confidentiality, practical resistance to derivation and protection from non-holder use, and shall neither alter data to be signed nor prevent their display before signing. Regulations shall set conformity and technical-assessment requirements.

Qualified certificates shall identify their qualified status, provider details, signatory’s name or legally permitted pseudonym, signature-verification data, validity period, unique identifier, provider signature or seal, location for status checking and any material use restrictions.

Electronic seals establish that data originate from a legal person and ensure origin and integrity. A qualified seal creates a presumption of integrity and the origin stated in its certificate. A seal alone does not prove a natural person’s intent to undertake a legal act unless law or circumstances establish it.

Timestamps shall not be rejected as evidence merely because they are electronic. Qualified timestamps create a presumption of date and time accuracy and associated-data integrity within the service standard. Time shall be linked to a trustworthy, calibrated source.

Data transmitted through registered electronic delivery shall not be denied legal effect. Qualified services provide evidence of sender and recipient identity where appropriate and sending and receipt dates and times, protecting data from undetected alteration under regulatory requirements.

Trustworthy archiving preserves readability, integrity and verifiability of origin and attributes throughout retention despite technological change. Timestamps may be renewed or formats converted through a documented preservation chain without undermining evidentiary value.

Trusted website and domain authentication certificates may establish and link the responsible entity’s identity. They do not guarantee content or legality of all activities and shall not be displayed as implying broader guarantees.

Electronic attestations may establish attributes, rights or facts derived from reliable sources, identifying source, issuance date, validity and verification mechanism. Responsibility for correctness shall follow the respective roles of source, provider and relying party under this Law.

A trust service using electronic records or distributed-ledger technology may be recognised if it reliably and auditably performs a defined legal function, without assuming technology itself guarantees legal truth. Regulations shall establish accreditation without favouring a particular architecture.

Providers shall follow clear published policies, verify subscribers’ identities according to service level, use qualified systems and staff, protect keys and secrets, manage incidents and vulnerabilities, retain necessary records, provide certificate and service status, manage complaints, maintain termination plans and comply with data-protection and cybersecurity rules.

Subscribers shall provide accurate information, protect credentials and signature-creation data from others’ use, immediately report suspected loss, misuse or substantive data changes, and respect published certificate restrictions.

A relying party shall, where reasonable, verify certificate status, scope, restrictions and service level and shall not disregard a clear warning or revocation notice. Liability shall reflect risk, transaction type and availability of verification means.

Providers shall immediately suspend or revoke certificates or credentials on legal or security grounds, particularly an authenticated holder request, established loss of control over creation data, inaccurate material information or an authority or court order. Status shall be available reliably without delay.

Qualified providers shall maintain approved plans for termination or total or partial cessation, including subscriber and authority notification, transfer or preservation of records, continued status availability, secure key invalidation and continued verification of past services throughout statutory periods.

A ‘Digital Identity and Trust Services Regulatory Directorate’ shall be established within the Ministry of Communications to regulate, license and technically supervise identity-management and trust services. Licensing and supervisory decisions shall be functionally independent of any company or government body operating services.

Licensing and supervision of a provider may not be assigned to the operating unit competing with it or providing the same service. Regulations shall govern institutional and financial separation and conflicts of interest.

The authority shall establish technical standards and policies; license or accredit qualified services; manage the national trusted list; accredit or recognise conformity-assessment bodies; inspect and audit; receive incident reports and regulatory complaints; issue corrective orders; coordinate with identity, civil-register, data-protection, cybersecurity, banking and communications bodies; and conclude mutual-recognition arrangements within its powers.

NPKI shall be managed with clear separation among the national or approved roots, regulator and providers. Regulations shall specify certificate policies, key management, backups, generation and revocation ceremonies, audit and business continuity. Sole individual access to critical root keys is prohibited.

The authority shall publish an updated, digitally signed list of qualified providers and their specified services, status, and qualification start and end dates. It shall be freely accessible to systems and the public in machine-verifiable formats.

No service may be offered as qualified without a licence. Licensing requires legal eligibility, financial and technical capacity, governance, competent staff, security and privacy policies, proportionate insurance or financial security, continuity and termination plans, and an independent conformity-assessment report.

Qualified services shall undergo initial and periodic independent assessment by a recognised body against published national or international standards appropriate to the service. A report does not remove authority or provider responsibility. Additional testing may be required for material risk or a major incident.

With national standardisation and cybersecurity bodies, the authority shall adopt internationally compatible standards, open wherever possible. Regulations shall specify protective functions and assurance levels rather than a commercial product or single algorithm, permitting updates without amending the Law.

Providers shall retain sufficient records of operations, security decisions, identity verification and certificate issuance, suspension and revocation for service-specific regulatory periods, protected from tampering and unauthorised access. Audit logs themselves shall follow data minimisation.

Qualified providers shall notify the authority and national cybersecurity body without undue delay of incidents materially compromising service security, key integrity or user trust, and take containment, recovery and notification measures. Affected individuals shall be informed where the incident is likely to pose high risk to their rights.

Credential, identity and operational records are confidential according to their nature and may be used only for legally or contractually specified purposes. Providers are subject to Personal Data Protection and Digital Privacy Law provisions. Authentication logs may not create behavioural or commercial profiles beyond the original purpose without an independent legal basis.

Licence and government-service fees shall be set by lawful decision or regulation under published rules proportionate to cost and regulatory purpose. Basic digital identity necessary for public services may not be conditional on exclusionary fees. Optional added-value services may be charged.

Foreign identity-management or trust services shall not be rejected merely for foreign origin. Recognition may follow demonstrated substantive equivalence in reliability and safeguards to the corresponding domestic level, through assessment, agreement or a recognition mechanism adopted by law or the authority.

Cross-border recognition may use a general decision for a defined class, international agreement or authorised implementing memorandum, assessment of a particular provider or service, or reliance on a trusted foreign list. Scope, effects, duration and suspension or termination procedures shall be specified.

Foreign signatures, seals or timestamps may receive legal effect equivalent to domestic counterparts if substantively equivalent. Technical architecture and server location need not exactly match Iraq’s where required trust and protection functions are achieved.

Foreign identification means may be accepted for Iraqi services or transactions according to assurance level, subject to entry, residence, anti-money-laundering, sanctions and sector-specific obligations. Acceptance does not recognise nationality, residence or substantive status not established under Iraqi law.

Under a Council of Ministers timetable, public bodies shall accept national digital identity and recognised identification means for electronically performable transactions and refrain from requesting paper copies of data verifiable directly from lawful official sources.

Public bodies shall use authorised individuals’ electronic signatures and institutional electronic seals according to assigned powers. Seals shall not conceal the official responsible for decisions requiring individual accountability. Audit logs shall identify who authorised the procedure.

Registered electronic delivery may serve administrative notices where special law permits, the recipient consents or an official digital account is adopted for that purpose. Ordinary email alone does not replace lawful service where reliable delivery proof is required.

Procurement shall ensure interoperability, open standards, state ownership of its data and critical keys, and supplier-transition plans. Contracts may not prevent transfer of data, administrative keys or records needed for continuity upon expiry, while protecting legitimate trade secrets.

All identity and trust components shall apply privacy and security by design and default, including data minimisation, separate identifiers where possible, encryption, risk-based multi-factor authentication, audit logs, periodic testing and limits on cross-service user tracking.

Users shall be informed clearly of the identity means or service, assurance level, provider, required data and purpose, material restrictions, and procedures for challenge or reporting loss or misuse. Material legal effects may not be hidden in lengthy or obscure terms.

Everyone may complain to a provider and receive a reasoned response within a reasonable period and challenge licensing or service decisions before the authority within its remit, without prejudice to recourse to courts, data-protection bodies or other competent regulators.

Identity or trust providers are liable for damage caused by intentional or negligent breach of mandatory legal or technical duties, considering the roles of the injured party, relying party and data source. A qualified provider bears the burden of proving absence of intent and negligence when requirements directly under its control fail.

Providers may restrict certificate or service use, transaction value or type where restrictions are clear and verifiable before reliance. Unpublished or ambiguous limits cannot be invoked. Liability for fraud, gross negligence or breach of fundamental security duties may not be excluded by agreement.

After allowing representations except in urgent cases, the authority may warn, order correction or service restriction, suspend qualified status or a licence, revoke a licence, or require publication of a correction or user notification where necessary for protection. Measures shall be reasoned, proportionate and appealable.

Administrative fines may address serious regulatory violations specified by law or regulation, considering severity, duration, persons affected, benefit obtained, cooperation, compliance history and economic capacity. No monetary penalty may be imposed without a provision defining its scope and maximum under the legality principle.

Without prejudice to the Penal Code and Information Technology Crimes Law, relevant criminal provisions shall punish intentional falsification of certificates or credentials; appropriation of signature-creation or digital-identity data for impersonation; unauthorised issuance of qualified services or a national trust mark; or destruction of trust records to conceal evidence. Mere technical error or civil breach does not create criminal liability without the elements of an expressly defined offence.

Final authority decisions may be appealed before competent administrative courts under statutory periods and procedures. Appeal does not prevent an application to stay enforcement where conditions are met. Civil, commercial and compensation disputes remain with competent courts.

Licences, certificates and certification services issued under Electronic Signatures and Electronic Transactions Law No. (78) of 2012 and Instructions No. (1) of 2025 retain their effects until expiry or no more than twenty-four months after commencement, whichever is earlier, unless the authority permits continuation after this Law’s requirements are met.

Existing certification and trust providers shall align their status within eighteen months. The authority shall maintain verification of past signatures and certificates, revocation records and archives through a transition plan. Transition shall not remove evidentiary force from a valid transaction made under the law applicable at the time.

The Council of Ministers shall issue implementing regulations within twelve months of publication. The Minister of Communications and competent bodies may issue instructions and standards within their remits, particularly on identity assurance levels, trusted lists, conformity assessment, qualified devices, incidents, fees and cross-border recognition, publishing them and allowing appropriate technical consultation where possible.

Within eighteen months, the Council of Ministers shall submit amendments harmonising references to signatures, documents, seals, attendance and service in existing laws, permitting functional equivalence where no substantive barrier exists. The package shall coordinate with evidence, procedure, commerce, companies, banking, notarial, property registration, national-card, digital-government, data-protection and cybersecurity legislation.

Electronic Signatures and Electronic Transactions Law No. (78) of 2012 is repealed at commencement. Its regulations, instructions and decisions remain effective insofar as consistent until replaced, without exceeding this Law’s transitional periods.

This Law enters into force ninety days after publication in the Official Gazette. Provisions needing regulations or transitional infrastructure become mandatory under the specified periods. Fundamental rights and safeguards may not be postponed because instructions are delayed.