BahamasComputer Misuse Act 2003, unauthorised access, modification and interception offences
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2003/2003-0002/2003-0002.pdfIn force since .
A computer misuse rule binding public and private bodies.
- Enforcement body
- Royal Bahamas Police Force
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not cause a computer to perform any function to secure access to a program or data without being entitled to control that access or having the consent of someone who is.
- Do not modify computer material, intercept a computer service, or obstruct the use of a computer without authority.
- Treat a computer used for security, defence, banking, financial services, public utilities, public transport, or public-safety systems as carrying enhanced criminal exposure for unauthorised access.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorised access (section 3) is punishable on summary conviction by a fine not exceeding five thousand dollars or imprisonment not exceeding six months, rising to ten thousand dollars or one year for a repeat conviction, and to twenty thousand dollars or three years where damage results. Unauthorised modification (section 5) carries the same tiers as section 3. Unauthorised use or interception of a computer service, and unauthorised obstruction (sections 6-7), carry a fine not exceeding ten thousand dollars or three years' imprisonment, rising to twenty thousand dollars or three to five years for a repeat conviction, and to fifty thousand dollars or five years where damage results. Unauthorised disclosure of an access code (section 8) carries a fine not exceeding ten thousand dollars or three years, rising to twenty thousand dollars or five years for a repeat conviction. Access to a protected computer under section 9 is liable on conviction to a fine not exceeding one hundred thousand dollars or imprisonment not exceeding twenty years.
Penalty structure
Section 9's enhanced-punishment tier for a protected computer caps a fine at one hundred thousand dollars (twenty years' imprisonment); the base offences in sections 3 and 5-8 carry lower tiered caps ranging from five thousand to fifty thousand dollars depending on the offence, repeat conviction, and whether damage resulted.
- Rule
- Fixed only
- As of
- Currency
- BSD
- Fixed cap
- 100,000
What it makes you log
Logging duty
Sections 3 to 9 define the offences of unauthorised access, access with intent to commit a further offence, unauthorised modification, unauthorised use or interception of a computer service, obstruction, disclosure of an access code and offences against protected computers. They impose no duty to create, keep, produce or review a log or record. Section 11(4) applies the Act where the accused was in The Bahamas or the computer, program or data was there; the limb that turns on where the computer or data sits is not coded.
- Kind
- None
- As of
What this law does
Section 3 makes it an offence for any person, without authority, knowingly to cause a computer to perform a function for the purpose of securing access to a program or data, whether or not the act was directed at any particular program, data, or computer. Access is unauthorised if the person is not entitled to control access of that kind and lacks consent from someone who is, so authorisation, not the technical means of access, is what the Act tests.
Sections 5 to 8 separately criminalise unauthorised modification of computer material, unauthorised use or interception of a computer service, unauthorised obstruction of a computer's use, and unauthorised disclosure of an access code.
Section 9 imposes enhanced punishment where the computer accessed is a protected computer used for security, defence, confidential law-enforcement sources, banking, financial services, public utilities, public transport, public key infrastructure, or public-safety systems. The Act applies whatever the offender's nationality where either the accused or the computer, program or data was in The Bahamas at the material time.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .