This article examines how UAE platforms operating in Iraq should separate Iraqi customer data when a regional affiliate is sold. A regional sale may cover systems holding Iraqi customer information that belongs to several group businesses. The buyer needs access to what it is acquiring, while the seller must protect information connected with retained operations.
Iraq does not yet have a comprehensive data protection statute. The relevant framework includes the Constitution of the Republic of Iraq of 2005, which protects privacy and the confidentiality of communications; the Civil Code No. 40 of 1951 on contractual obligations and civil liability; the Companies Law No. 21 of 1997 on corporate transfers; the Electronic Signature and Electronic Transactions Law No. 78 of 2012; and the Penal Code No. 111 of 1969, which penalises unlawful disclosure of secrets. Sector rules, for example for banking, payments and telecommunications, require separate assessment.
The transaction and the customer relationship
A share sale may leave Iraqi customers contracting with the same legal entity, while an asset sale may involve transferring contracts and moving data to a new provider. These structures should be distinguished before deciding which customer notices, consents or regulatory approvals are needed.
A review of Iraqi commercial and technology contracts should establish who supplies the service and who may use the information. Describing a database as an asset in the sale agreement does not resolve privacy, confidentiality or contractual restrictions on its contents. Under the Civil Code, assigning a contract generally requires the counterparty’s consent, and customers’ rights require their own analysis.
Separation before completion
The parties should identify data belonging to the business being sold, retained businesses and shared services. One customer may deal with several group entities, so separating records by customer name alone may not work; the relevant purpose, contract and system should guide the exercise.
Due diligence access should be proportionate. Aggregated data, clean-room access or redaction can address many concerns without disclosing full customer records. A confidentiality agreement is useful but does not authorise every disclosure, and regulated information, such as payment or communications data, may need additional permission before it is shared.
Transition services and continuing access
After completion, the seller may continue hosting systems or providing support. The transition services agreement should define which information each party may access, for what purpose and for how long. Shared administrator accounts can undermine these limits by letting staff view retained business data freely.
Technical separation should be backed by contractual duties and evidence of implementation, with access rights, logs and incident procedures matching the legal allocation. The parties should agree who handles customer and authority requests during transition, including requests about pre-completion records held in the buyer’s systems. Access needed to operate licensed software should be distinguished from permission to use customer data stored in it.
Regulatory approvals for licensed platforms
Platforms holding Iraqi payment, telecommunications or similar licences may need regulatory approval for a change of control or for transferring customer relationships. The Central Bank of Iraq and the Communications and Media Commission, for example, regulate licensed payment and communications providers, and a sale structured without their consent can put the licence at risk. These approvals should be identified early and built into completion conditions.
Records that must remain with the seller
The seller may need to keep certain records for tax, employment or existing claims. These should be identified separately from the operational database being transferred. Iraqi retention requirements should be respected without creating a general right to keep and reuse all customer information indefinitely.
A review of Iraqi corporate transaction arrangements should link data access to the warranties and indemnities in the sale documents. A party defending a historical claim may need access to evidence, subject to safeguards. The agreement should also cover export formats, deletion procedures and any permitted residual copies, so that neither side is left unable to meet continuing legal obligations.
Customer communication and consent
Even where no specific consent is legally required, informing Iraqi customers about a change in service provider supports trust and reduces complaints. Contracts with business customers may require notice or consent for assignment, and some may contain termination rights triggered by a change of control. These provisions should be identified during due diligence so that the buyer understands which customer relationships may be at risk.
Communications should accurately describe the new arrangement, including which entity will provide the service and handle personal information. Where customer consent is obtained, it should be recorded in a way that can be evidenced later. The seller and buyer should agree the content and timing of communications, avoiding statements that could be read as promises neither party intends to keep, such as unchanged pricing or service levels after the transition.
Conclusion & how Etihad Law Firm can help
Data separation should reflect the legal relationships behind the platform, not just the architecture of its systems, and should be planned well before completion.
As Iraq data protection legal advisors for UAE-based companies, Etihad Law Firm advises on customer contracts, privacy and regulatory approvals in regional disposals, structures due diligence and transition access, and drafts data provisions in sale documents, helping groups manage the rights and obligations that continue after completion.