Iran

Summary

Iran presents high legal risk for crawling, driven primarily by the Computer Crimes Law (CCL) of June 2009 (Law No. 71063), which broadly criminalises unauthorized access to any computer or network protected by a security mechanism. Art. 1 CCL imposes penalties of 91 days to 1 year imprisonment or fines for unauthorized access to protected data or systems; Art. 4 adds 6 months to 2 years for unauthorized access to secret or classified data. The state exercises extensive control over the internet (internet filtering, VPN restrictions, ISP data-retention mandates), which creates an environment where crawling may attract official scrutiny beyond the letter of the CCL. There is no comprehensive personal- data protection law; the Electronic Commerce Law 2003 contains limited e-consumer data provisions, and a draft Personal Data Protection Law has been pending parliamentary review since at least 2019 without being enacted. The Copyright Law (Law on the Protection of Authors, Composers and Artists' Rights, 1970, as amended) has a closed exceptions list with no TDM exception; there is no EU-style sui generis database right. Iran is not a member of major international IP conventions (not a member of Berne Convention as of 2026). A new bill expanding internet censorship powers was being considered in parliament in 2025. Confidence is low due to limited English-language legal sources, state-controlled enforcement context, and pending legislative changes.