There is currently no modern data protection law in Iraq, and there is accordingly no Data Protection Authority. There are Iraqi law considerations that could be material in the context of considering personal data processing activities, either in an HR context or more broadly. These have not been prepared with GDPR in mind. They range from general provisions protecting privacy or providing for remedies where someone causes damage to another. Depending on the circumstances of a data breach, it may be prudent to consider notifying law enforcement authorities and affected individuals, although there is no generally applicable legal obligation to do so.