Law / Afghanistan

Afghanistan

privacy

Afghanistan has no comprehensive personal-data-protection law, before or after the 2021 change of government.

Under the pre-2021, internationally recognized government, the 2004 Constitution supplied general communications privacy (Art. 37) and home inviolability (Art. 38) rights, read directly from primary text and authored here as a bare constitutional-rights instrument, the same shape as Timor-Leste's and Palestine's constitutional privacy provisions elsewhere in this wave: it creates no lawful-basis regime, data-subject rights, or supervisory structure.

The 2014/2018 Access to Information Law separately contained a privacy exemption (a ground for withholding disclosed information, not a private-sector processing duty), read directly but not authored as an instrument, since an exemption from disclosure is not itself a processing duty.

A source for the 2017 Penal Code's cybercrime chapter was left unreached rather than bypassed, after `bin/readlaw.py` hit a Cloudflare CAPTCHA challenge on the only URL located; this is a sourcing gap, not a finding about the law.

A freshly sourced, significant development not in the derivation seed: on 4 and 7 January 2026 the Taliban administration promulgated a new Criminal Procedure Code and "Penal Principles of Taliban Courts" (119 articles), effective immediately with no public consultation, which multiple independent outlets describe as replacing the prior penal code and further undermining the 2004 Constitution's operative status.

No source locates that new framework's text, so whether it addresses personal data or privacy at all, positively or negatively, could not be established, and no formal repeal or supersession of Articles 37 or 38 has been located either; the constitutional instrument above remains coded in effect on that basis, and no post-2026 instrument establishing or denying a personal-data duty could be sourced.

5 instruments named 1 researched in detail As of 2026-08-29

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Comprehensive regime

Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)

cite Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38 stage IN FORCE in force since 2004-01-26 binds public and private bodies source Constitution of the Islamic Republic of Afghanistan

What it requires →

Article 37, read verbatim in full, secured freedom and confidentiality of correspondence and communications from state intrusion absent legal authorization, and Article 38 made personal residences immune from entry or search without the owner's permission or a court order.

Neither article defines personal data, sets processing conditions, or establishes a supervisory authority; both are bare constitutional rights enforceable against the state rather than a comprehensive regime, the same shape as comparable constitutional privacy provisions elsewhere in this wave.

On 4 and 7 January 2026 the Taliban administration promulgated a wholly new Criminal Procedure Code and Penal Principles of Taliban Courts (119 articles), effective immediately with no public consultation, which multiple independent outlets describe as replacing the prior penal architecture and further undermining the 2004 Constitution's operative status; no source locates that new framework's text, so whether it addresses personal data or privacy at all could not be established, and no formal repeal or supersession of Articles 37 or 38 has been located, so this instrument remains coded in effect.

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.