BhutanInformation, Communications and Media Act of Bhutan 2018, unauthorized access and tampering with computer systems
Information, Communications and Media Act of Bhutan 2018, ss.415-416
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer, computer system, network, or computer, content, or traffic data without authorization; unauthorized access is a felony of the fourth degree regardless of resulting damage, and the person is liable to pay court-determined compensation to the victim.NIST AI RMFMAP 4.1
- Do not cause a stoppage or denial of service, delete or alter data, diminish a system's value or utility, or introduce a computer contaminant, with intent to cause or knowing it is likely to cause wrongful loss, gain, or damage; this is punishable as tampering with computer material under the Penal Code of Bhutan.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
ICMA s.416 grades unauthorized access to a computer, computer system, network, or data a felony of the fourth degree. Under the Penal Code of Bhutan (as amended by the Penal Code (Amendment) Act of Bhutan 2011 and 2021), s.11, a felony of the fourth degree carries imprisonment of a minimum of three years and a maximum of less than five years.
Who enforces it
Enforcement body
The Courts of Bhutan adjudicate the offence and determine the compensation award; the Act does not describe a separate administrative enforcement role for the Bhutan InfoComm and Media Authority (BICMA) over ss.415-416.
Settledness
- As of
- Open questions
- Does "unauthorized access" in section 416 reach retrieving pages that a site publishes without a login, when the Act's definitions section defines neither "access" nor "unauthorised"?
What it makes you log
Logging duty
Sections 415 and 416 define the offence of tampering with computer material and the offence of unauthorized access to computers, computer systems, networks and computer, content and traffic data, and section 416 grades the second a felony of the fourth degree with court-determined compensation. They impose no duty to create, keep, produce or review a log or record. Section 4 reaches an offence committed outside Bhutan only if it involves a computer system or network located in Bhutan, a test of where the system sits, which has no hook value. Provisions outside the sections this row covers include section 379 (the Minister may, by court warrant, authorise an agency to monitor and collect traffic data) and section 188 (the Authority may require a licensee to retain recordings of programmes broadcast for at least six months).
- Kind
- None
- As of
What this law does
Section 415 makes it an offence, keyed to intent to cause or knowledge that it is likely to cause wrongful loss, gain, or damage, to access a computer, computer system, network, or computer, content, or traffic data and thereby cause a stoppage or denial of service, delete or alter data, diminish a system's value or utility, or introduce a computer contaminant; the section labels this "tampering with computer material", punishable under the Penal Code of Bhutan.
Section 416 separately makes unauthorized access to a computer, computer system, network, or computer, content, or traffic data an offence in its own right, without requiring the loss, gain, or damage element of section 415, graded a felony of the fourth degree with court-determined compensation to the victim.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .