Czech RepublicCriminal Code Section 230, Unauthorized Access to a Computer System
Zakon c. 40/2009 Sb., trestni zakonik, Sec. 230
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not overcome a security measure to gain access to a computer system or part of it in the Czech Republic, and do not use, delete, alter, forge, insert or transmit data, or otherwise interfere with a computer system's software or hardware, without authorization.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Trestni zakonik Sec. 230(1): up to two years' imprisonment, a ban on activity, or forfeiture of property for overcoming a security measure to gain unauthorized access to a computer system or part of it. Sec. 230(2): up to three years for unauthorized use, deletion, destruction, damage, alteration, suppression or degradation of data, forging or altering data to pass as genuine, or unauthorized insertion or transmission of data or interference with a computer system's software, hardware or other technical equipment. Sec. 230(3): six months to four years where the Sec. 230(1) or (2) act is committed with intent to cause damage or another harm, to obtain an unauthorized benefit, or to restrict a computer system's functionality. Sec. 230(4): one to five years for an organized-group offence, significant damage, an attack on a computer system whose disruption would seriously affect the functioning of the state, public health, safety, the economy or the population's basic needs, a significant benefit, or serious disruption to a business. Sec. 230(5): three to eight years for large-scale damage or a large-scale benefit.
Who enforces it
Settledness
- As of
- Open questions
- Does a login, a CAPTCHA or a rate limit count as a 'bezpečnostní opatření' whose overcoming gives 'neoprávněný přístup' under Section 230(1)?
- Does a person who holds a valid account and uses it against the operator's terms 'neoprávněně získá přístup' to a computer system under Section 230(1)?
What it makes you log
Logging duty
Section 230 defines the offences of overcoming a security measure to gain unauthorized access to a computer system and of unauthorized interference with a computer system or data carrier. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Whoever overcomes a security measure and thereby gains unauthorized access to a computer system or part of it faces up to two years' imprisonment, a ban on activity, or forfeiture of property; this offense turns on whether a technical security measure was circumvented, not on whether a website's terms of use were violated alone.
A separate paragraph reaches unauthorized use, deletion, alteration, forgery, insertion or transmission of data, or another interference with a computer system's software or hardware, with no security-measure element, carrying up to three years.
The penalty rises to six months to four years where the act is committed with intent to cause damage or gain an unauthorized benefit, or to restrict a computer system's functionality; to one to five years where committed by an organized group, causes significant damage, targets a computer system whose disruption would seriously affect the state, public health, safety, the economy, or the population's basic needs, secures a significant benefit, or seriously disrupts a business; and to three to eight years for large-scale damage or a large-scale benefit.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .