This article examines the legal framework for remote access from Germany to industrial systems in Iraq, focusing on security responsibilities and permissions over customer data. Remote diagnostics save time and travel, but the same connection may expose production records, employee identifiers and confidential designs, and a general maintenance clause rarely authorises every form of access.
Iraq does not yet have a comprehensive data protection statute. The relevant rules are spread across the Constitution of the Republic of Iraq of 2005, which protects privacy and the confidentiality of communications; the Iraqi Civil Code No. 40 of 1951 on contractual and tort liability; the Penal Code No. 111 of 1969, which penalises unlawful disclosure of secrets; the Electronic Signature and Electronic Transactions Law No. 78 of 2012; and sector rules such as the banking secrecy provisions of the Banking Law No. 94 of 2004 and the regulatory framework of the Communications and Media Commission.
Identifying the applicable duties
The legal assessment should follow the actual information and activity involved. Banking secrecy raises different issues from access to an anonymous temperature reading, and data from oil, power or telecommunications operators may be subject to additional security expectations from the relevant ministry or regulator. A generic European privacy template will not capture these distinctions.
Neither extreme is safe: not all industrial data is personal data, but operational data is not free of restrictions either. Drawings and production recipes may be confidential even when they identify no individual. German and EU obligations, including the GDPR where it applies to the supplier, should be assessed separately; they do not replace the Iraqi customer’s own legal responsibilities.
Who can authorise each activity
The customer should confirm its authority to permit access to the relevant systems and information. Owning a server does not give unrestricted rights over every record on it: employee data, third-party designs and information received under other contracts may carry their own limits.
The access schedule should identify the systems, data categories and permitted purposes; whether the supplier may only view information or may also download copies or change settings; the approved personnel, subcontractors and countries from which access is made; situations requiring specific approval before an intervention; and retention and deletion rules once support ends. Permission to investigate one fault should not silently become permission to reuse customer data for product development or benchmarking.
Allocating security responsibilities in practice
Security expectations should be translated into identifiable obligations: account management, approval of access, authentication, connection logs and removal of departing personnel. The customer should be able to revoke access quickly, and emergency interventions should be documented. If an incident leads to a claim under the Civil Code, these records will show what was promised and what was actually done.
A clause making one party responsible for all security while the other controls key systems invites dispute. Typically, the German supplier controls its support environment and the Iraqi customer controls local networks and staff permissions. Each function should be allocated expressly, with an obligation to cooperate when either side detects a vulnerability or unauthorised connection.
Responding lawfully to incidents
An incident procedure should define notification between the parties, authority to contain the incident and preservation of evidence. External reporting duties must be assessed for the relevant sector and facts, as there is no general statutory breach-notification deadline in Iraq; contractual deadlines can still be agreed, provided they are described as contractual.
Logs and diagnostic records may decide whether damage resulted from remote instructions, local configuration or an unrelated failure. They should be preserved without expanding access beyond what is authorised. Admissions, compensation offers and communications to third parties should come from authorised representatives, particularly while facts are disputed.
Criminal exposure and confidentiality
Unauthorised access to or disclosure of confidential information can carry criminal consequences under the Penal Code, in addition to civil liability. Support engineers should understand the limits of their access, and contracts should prohibit copying data to personal devices or unapproved locations. Confidentiality obligations should survive termination and extend to subcontractors, with a clear route for the customer to verify compliance.
Where systems belong to state entities or operate critical infrastructure, the customer may require prior security clearance or impose restrictions on access from abroad. These conditions should be identified during contracting, since a support model built on unrestricted remote access may simply not be permitted for some public operators.
Ending access without losing evidence
Termination should address account closure, return or deletion of information and retention needed for legal claims, confirmed through a written record. Customer consent to access should not be read as a blanket release from confidentiality or civil liability.
Cross-border transfer and storage of Iraqi data
Remote support often involves copying logs or datasets to servers in Germany or elsewhere. While Iraq has no general statutory restriction on transferring data abroad comparable to European regimes, certain sectors, including banking, telecommunications and government, may impose restrictions through their regulators or through contract. Customers should identify any data that must stay in Iraq, and suppliers should design support processes that work without exporting it, for example through in-country analysis or anonymised extracts. Contracts should state where data may be stored, for how long, and who may access it.
Conclusion & how Etihad Law Firm can help
Remote support is efficient only when access, data use and security duties are defined precisely. As Iraq data protection legal advisors for German companies, Etihad Law Firm assesses the constitutional, civil, criminal and sector rules that apply to industrial data in Iraq, drafts remote-support and confidentiality terms, and advises both suppliers and operators when incidents occur.