Law note · Iran
Electronic Commerce Law (2003), Personal Data Chapter
What it requires
- An app that stores, processes, or distributes data revealing a Iranian resident's tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition needs their explicit consent first. Any other collection or processing of personal data needs consent for a specified, described purpose, must be limited to that purpose, must stay accurate, and must let the person access their own data with a right to have it corrected or completely removed. The law names no biometric category, so a voiceprint or faceprint is not subject to a heightened consent, retention, or destruction standard beyond the general consent-based rule, and nothing in this chapter conditions moving personal data out of Iran or requires notifying anyone after a security incident. Violating Article 58's sensitive-data consent rule is a criminal offense (one to three years' imprisonment), state-prosecuted rather than privately actionable.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
- Private right of action
- No
What we found
Article 58 requires explicit consent before storing, processing, or distributing data revealing tribal or ethnic origin, religious or moral belief, ethical characteristics, or physical, psychological, or sexual condition; this is Iran's complete sensitive-category list and it names no biometric category.
Article 59 sets a general consent-based processing standard (specified purpose, data minimization, accuracy) and gives the data subject access to their own files with a right to correct or completely remove them. Article 60 defers medical and health-record data to separate, unlocated regulations, and Article 61 defers exceptions and "supervision and control" to other chapters without spelling out a dedicated regulator.
Enforcement is criminal only, one to three years' imprisonment under Article 71 (enhanced for institutional offenders under Article 72), with no described administrative penalty scheme and no private right of action found. No cross-border-transfer provision and no breach-notification duty were found anywhere in the chapter.