Legal Protection of Electronic Commercial Enterprises against Cybersecurity Risks: A Comparative Analytical Study under Iraqi Legislation

Abstract

A growing number of Iraqi merchants trade with no shop at all. What they own is a web address, a customer list, a platform account, a way to take payments and a reputation built slowly from buyer reviews. We treat this bundle as an electronic commercial establishment: an intangible asset that one intrusion can seriously harm. We ask how far Iraqi law protects it against hacking, data theft, ransomware, website outages, impersonation and payment fraud, looking in turn at prevention, criminal sanctions and civil redress, with Egypt and the UAE as points of comparison. Our finding is that Iraqi protection is patchy and borrowed from rules made for other ends. Criminal provisions dating from 1969 struggle with legality and with a notion of property built around physical objects. The long-awaited cybercrime bill had only a first reading in July 2026. The 2025 e-commerce regulation tells merchants to keep customer data safe, yet names no security benchmark and no reporting deadline. Civil liability under the 1951 Civil Code works in principle, although courts still have to settle what the duty of security requires and whether an attack can ever excuse the business as an outside cause. We recommend legislation that punishes interference with systems and data, fixes minimum safeguards proportionate to the size of the business, sets up incident reporting and rewards firms that insure against cyber loss.