LexLint.ioBeta

Know the law your code answers to.

Law / Burkina Faso

Loi n°025-2018/AN du 31 mai 2018 portant Code pénal, computer and data systems offenses (Livre VII, Titre I, Chapitre 1)

Loi n°025-2018/AN du 31 mai 2018 portant Code pénal Livre VII, Titre I, Chapitre 1 (infractions relatives aux systèmes et données informatiques, Art. 711-1 à 711-13)

In force.

A computer misuse rule binding public and private bodies.

Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not access, or remain present in, a computer system without right; a heavier penalty applies where the access or continued presence results in data being suppressed, modified, or altered.NIST AI RMFMAP 4.1
  • Do not hinder or falsify the operation of a computer system, or introduce, damage, delete, alter, or suppress computer data without right.no control in the NIST AI RMF
  • Do not intercept a non-public data transmission to, from, or inside a computer system without right.NIST AI RMFMAP 4.1
  • Do not reproduce, extract, or copy computer data belonging to another person without right.NIST AI RMFMAP 4.1
  • Do not produce, sell, obtain, import, or distribute a device, program, password, or access code intended to commit any of the above offenses, unless it is for authorized testing or protecting a computer system.no control in the NIST AI RMF
  • Do not take a person's digital identity, or use data identifying them, in order to disturb them or harm their honor, private life, or property.no control in the NIST AI RMF

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Imprisonment of two months to two years and a fine of 250,000 to 600,000 CFA francs for unauthorized access (Art. 711-1), rising to one to five years' imprisonment and a fine of 1,000,000 to 5,000,000 CFA francs where data is suppressed, modified, or altered; up to one to ten years' imprisonment and a fine of 1,000,000 to 4,000,000 CFA francs for unauthorized data reproduction, extraction, or copying (Art. 711-13); up to eleven to twenty-one years and 10,000,000 to 50,000,000 CFA francs for organizing or joining an association formed to commit these offenses (Art. 711-11).

Penalty structure

Base band for unauthorized access under Art. 711-1, rising to 1,000,000 to 5,000,000 CFA francs where the access results in data suppression, modification, or alteration. Other offenses in the same title carry their own, higher bands: 1,000,000 to 4,000,000 CFA francs for unauthorized reproduction, extraction, or copying of another's computer data (Art. 711-13), and 10,000,000 to 50,000,000 CFA francs for participating in an association formed to commit these offenses (Art. 711-11).

Rule
Fixed only
As of
Minimum
250,000
Currency
XOF
Fixed cap
600,000

Who enforces it

Enforcement body

Burkinabe public prosecution and the criminal courts

Settledness

As of
Open questions
  • Does "sans droit" (without right), the term on which Articles 711-1 and 711-13 turn, cover a person who reads or copies a publicly available web page with an automated client against the site's terms of use, given that Article 700-1 does not define it?
  • Does Article 711-13, which punishes reproducing, extracting or copying "des données informatiques appartenant à autrui" (computer data belonging to another), reach copying data that a site displays publicly, and what makes displayed data belong to another?

What it makes you log

Logging duty

Articles 711-1 to 711-13 of the Penal Code define the offences of unauthorized access to or presence in a computer system, hindering or falsifying its operation, interception, unauthorized copying or extraction of data, the supply of intrusion devices and misuse of a digital identity. They impose no duty to create, keep, produce or review a log or record. The personal-data duties in the next chapter (Articles 712-1 onward) are not cited by this row, and the cited articles carry no territorial clause.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Burkina Faso's general computer-misuse title, added to the Penal Code by Loi n°025-2018/AN. Article 711-1 punishes intentionally and without right accessing all or part of a computer system, with a heavier penalty where the access results in the suppression, modification, or alteration of the system's data; Article 711-2 separately punishes unauthorized continued presence in a system, on the same escalating structure.

Article 711-3 punishes hindering or falsifying a system's operation; Article 711-4 the unauthorized introduction of data; Article 711-5 the unauthorized interception of non-public data transmissions; Article 711-6 the unauthorized damaging, deletion, alteration, or suppression of data.

Article 711-10 punishes producing, selling, or possessing a device, program, password, or access code intended to commit any of the above offenses, but carves out production, sale, or possession that does not aim to commit an offense, such as authorized testing or protecting a computer system.

Article 711-12 punishes taking a person's digital identity or using their identifying data to disturb them or harm their honor, private life, or property, and Article 711-13 separately punishes intentionally and without right reproducing, extracting, or copying computer data belonging to another. The title does not define "without right" for a public, unauthenticated web page specifically, and no Burkinabe court decision construing Articles 711-1 to 711-13 in that context was located.

The National Assembly deliberated on the Code at its sitting of . The last article of the Code provides only that the law is to be executed as a law of the State, and the Code states no day of its own for its entry into force. No promulgating decree or Journal officiel issue carrying the Code has been located.

When LexLint raises it

When your app profile says your app crawls the web or trains models.

Back to the example  ·  Lint your app

Page updated .