BoliviaCódigo Penal, Alteración, Acceso y Uso Indebido de Datos Informáticos
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not appropriate, access, use, modify, suppress, or disable data stored on a computer or other computer medium without authorization, where doing so harms the data's owner.
- Reading a public, unauthenticated page without defeating any access control has not itself been tested against this provision, which turns on acting without authorization.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Prestación de trabajo (community service) of up to one year, or a fine of up to two hundred day-fines (días multa), a Bolivian sentencing unit calculated from the convicted person's income rather than a fixed currency sum (art. 363 ter).
What it makes you log
Logging duty
Article 363 ter punishes an unauthorized person who seizes, accesses, uses, modifies, deletes or renders unusable data stored in a computer or on any computer medium, to the data holder's harm. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 363 ter, inserted alongside article 363 bis by Ley No. 1768, punishes whoever, without being authorized, appropriates, accesses, uses, modifies, suppresses, or disables data stored on a computer or any computer medium, causing harm to the owner of the information, with prestación de trabajo (a community-service sentence, one of the Código Penal's four principal penalties) of up to one year or a fine of up to two hundred day-fines (días multa).
Because it turns on acting sin estar autorizado (without authorization), this is the article that would reach a scraper who defeats an access control to appropriate or use data it was not authorized to take. Like article 363 bis, it was listed among the norms Ley No. 1005 purported to abrogate in 2017, but Ley 1005 was itself abrogated by Ley No. 1027 before Ley 1005's eighteen-month deferred entry into force elapsed, so article 363 ter was never actually displaced.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .