This article examines how UK outsourcing contracts involving Iraqi operations should allocate data retention and deletion duties when the service ends. A contract may require the Iraqi provider to delete all customer information on exit, but that can conflict with obligations to keep employment, tax or regulated records, and may be technically incomplete if copies remain with subcontractors or in backups. Exit provisions should distinguish data to be returned, data that may lawfully remain and data to be deleted.
Iraq does not yet have a comprehensive data protection law. The Constitution of the Republic of Iraq of 2005 protects privacy, the Civil Code No. 40 of 1951 supports contractual confidentiality and civil liability, and the Penal Code No. 111 of 1969 penalises unlawful disclosure of secrets. Record-keeping duties arise under the Income Tax Law No. 113 of 1982 and the Labour Law No. 37 of 2015, and sector rules apply in banking and telecommunications. UK GDPR obligations require separate consideration.
Identifying the records and responsibilities
The parties should establish which entity controls each category of information and why the Iraqi provider holds it. Customer databases, employee files, accounting records and system logs involve different duties, and contractual ownership of a database does not settle every question about personal data within it.
Review of Iraqi outsourcing contracts should identify the systems, locations and subcontractors involved. Where UK data protection law applies, controller and processor roles and international transfer safeguards should be addressed expressly, but these obligations sit alongside Iraqi requirements and do not displace them simply because the contract is governed by English law.
Retention required by law or proceedings
Retention should be linked to an identified legal purpose and period. Iraqi tax law requires books and supporting documents to be kept for audit, labour law requires employment records, and sector regulators may impose further obligations. Pending litigation or an investigation may also require preservation of data otherwise due for deletion.
A general clause allowing the provider to keep any information for compliance purposes is too vague to manage. The agreement should require identification of the category, reason and safeguards for each retained item, and retention for a legal purpose should never become permission to use the customer’s data for marketing, product development or unrelated services.
Return and deletion procedures
The exit plan should specify the format and timing of data return and allow the customer to verify that the export is complete and usable before deletion. Premature deletion can disrupt operations or remove evidence of the provider’s performance.
Active systems, employee devices, archives and backups should be addressed separately. Immediate deletion from every backup may be impractical, but remaining copies need restricted access and a defined disposal timetable. A deletion certificate should describe what was done and any lawful exceptions, rather than claim inaccurately that no copies exist.
Local staff and on-premises records
Iraqi outsourcing operations often involve local staff using company laptops, paper files and messaging applications. Exit plans should cover recovery of devices, closure of personal and group messaging channels used for work, and destruction or return of paper records. Employees should be reminded of continuing confidentiality obligations, and their own employment records must be retained by the employer as Iraqi labour law requires.
Continuing access and responsibility
Customer accounts, administrator permissions and encryption keys need attention alongside the data. A service may end while the former provider retains access through an integration or an employee account, so responsibility for revoking access should be allocated and documented with access logs that evidence compliance without reproducing sensitive data.
Subcontractor obligations should support the exit, with the primary provider able to require and evidence completion. Where disputes arise, Iraqi dispute resolution advice may be needed to address competing demands for deletion, preservation or access. Withholding data to gain leverage over unpaid fees should be assessed carefully against confidentiality duties and the legal treatment of the information.
Planning exit at the start
The best time to agree exit arrangements is when the outsourcing contract is signed. An exit plan annexed to the contract, updated annually, can list systems, data categories, retention periods, return formats and responsible persons. Requiring the provider to maintain an up-to-date data inventory during the service makes exit far simpler. Customers should also secure audit rights that survive termination, so they can verify deletion and retention after the relationship ends.
Exit planning should also consider business continuity. Customers may need a parallel running period in which the incoming provider operates alongside the outgoing one, which requires both to have access to some data at the same time. The contract should allow for this, with clear rules on who may access what during the overlap and when the outgoing provider’s access must end.
Conclusion & how Etihad Law Firm can help
An effective outsourcing exit preserves legally required records while ending unnecessary access and processing in a verifiable way.
As Iraq data protection legal advisors for British companies, Etihad Law Firm reviews retention obligations under Iraqi law, drafts confidentiality and exit provisions, and advises on disputes over data at the end of outsourcing relationships, coordinating local requirements with the customer’s UK data protection arrangements.