LexLint.ioBeta

Know the law your code answers to.

Law / Colombia

Código Penal, Acceso Abusivo a un Sistema Informático

Ley 599 de 2000, art. 269A (added by Ley 1273 de 2009)

In force since .

A computer misuse rule binding public and private bodies.

Enforcement body
Fiscalia General de la Nacion
Obligation class
Access restriction
Audit expectation
none

What it requires

  • Do not access a computer system, whether or not it is protected by a security measure, without authorization or beyond what the system's owner agreed to, and do not remain in it against the will of the person entitled to exclude you.
  • This article's authorization test does not turn on defeating a technical access control, so it may reach unauthorized access to a public, unauthenticated page; no confirming Colombian decision exists.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
NIST AI 600-1
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI03Identity and Privilege Abuse
MIT mitigations Draft
  • 2.1Model & Infrastructure Security
  • 3.2Data Governance
FINOS AIGF
ETSI EN 304 223
  • 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages (art. 269A); the fine is expressed in monthly legal minimum wages rather than a fixed currency sum.

What it makes you log

Logging duty

Article 269A defines the offence of abusive access to a computer system, protected or not by a security measure, and of remaining in it against the will of the person entitled to exclude, and sets the penalty. It imposes no duty to create, keep, produce or review a log or record, and states no territorial test, so the hook is empty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 269A punishes whoever, without authorization or beyond what was agreed, accesses in whole or part a computer system protected or not by a security measure, or remains within it against the will of the person entitled to exclude them, with imprisonment of 48 to 96 months and a fine of 100 to 1,000 monthly legal minimum wages.

Because the article expressly covers a system whether or not it is protected by a security measure, its authorization test does not, on its plain text, require defeating a technical access control the way jurisdictions that condition the offense on infringing a security measure do.

When LexLint raises it

When your app profile says your app crawls the web or trains models.

Back to the example  ·  Lint your app

Page updated .