GabonLoi n°027/2023, infractions et sanctions informatiques
Loi n°027/2023 du 11 juillet 2023 portant réglementation de la cybersécurité et de la lutte contre la cybercriminalité en République… Gabonaise, chapitre Ier (art. 49-61)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://journal-officiel.ga/20087-027-2023-/In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Access restriction, Security
- Audit expectation
- none
What it requires
- Do not access or remain in a computer system without authorization, whether or not the system is protected by a technical measure, and do not exceed an access you were granted.
- Do not intercept data fraudulently, by technical means, during its non-public transmission to, from or within a computer system, including the electromagnetic emissions from a system carrying such data.
- Do not hinder the operation of a computer system, or fraudulently introduce, alter, delete, or extract the data it holds.
- Do not knowingly use data you know was obtained through one of these offences.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Base offences under arts. 49-56 range from five to ten years' imprisonment with fines from 50,000,000 up to 100,000,000 FCFA depending on the provision. Art. 77 raises every penalty under the law to twenty-five years' criminal detention and a fine of up to 500,000,000 FCFA where the offence is committed by an organized group, and applies the same raised penalty to an offence against a State information system or critical infrastructure. Art. 76 doubles the applicable penalty on recidivism. Art. 78 adds dissolution, a bar on operating, closure of an establishment, or exclusion from public tenders for a legal person that diverted its purpose to commit the offence.
Penalty structure
The base fine on the tiered scale tops out at 100,000,000 FCFA (alongside up to ten years' imprisonment) for fraudulent access exceeding an authorized access (art. 49), fraudulently introducing data (art. 52), intercepting data (art. 53), fraudulently introducing, altering, deleting, or extracting data (art. 54), knowingly using data obtained through these offences (art. 55), and dealing in access tools (art. 56). Fraudulently remaining in a system (art. 50) and hindering its operation (art. 51) each carry a lower cap of 50,000,000 FCFA alongside up to five years. A cryptology-specific offence (exporting or providing cryptology services without authorization, arts. 59-60) carries a lower cap again, 20,000,000 FCFA alongside up to five years. Art. 77 raises the true ceiling on any of these offences to 500,000,000 FCFA and twenty-five years' criminal detention where committed by an organized group or against a State information system or critical infrastructure, and art. 76 separately doubles the applicable penalty on recidivism.
- Rule
- Fixed only
- As of
- Currency
- XAF
- Fixed cap
- 500,000,000
Who enforces it
Enforcement body
Autorités judiciaires gabonaises
Settledness
- As of
- Open questions
- Does reading publicly available web pages by automated means amount to someone who "accède frauduleusement" ("accesses fraudulently") a computer system under article 49, when article 5 defines unlawful access but not fraudulently, and does ignoring a site's terms of use or technical limits count as "dépassement d’un accès autorisé" ("exceeding an authorized access")?
What it makes you log
Logging duty
Articles 49 to 61, the offences chapter this row cites, define fraudulent access, remaining in a system, hindering its operation, interception and the misuse of data. They impose no duty to create, keep, produce or review a log or record. The same Law's articles 20, 31 and 43 require operators, system operators and content providers to keep connection and traffic data and contents for ten years, but they sit outside articles 49 to 61 and the row does not cite them.
- Kind
- None
- As of
What this law does
Loi n°027/2023 punishes fraudulently accessing all or part of a computer system, including exceeding an authorized access, with up to ten years' imprisonment and a fine of up to 100,000,000 FCFA or one of these penalties; fraudulently remaining in a system or hindering its operation each carry up to five years and up to 50,000,000 FCFA or either penalty; and fraudulently introducing, altering, deleting, or extracting data, or knowingly using data obtained through any of these offences, each carry up to ten years and up to 100,000,000 FCFA or either penalty.
Article 53 punishes, with up to ten years' imprisonment and a fine of up to 100,000,000 FCFA or either penalty, fraudulently intercepting computer data by technical means during its non-public transmission to, from or within a computer system, including the electromagnetic emissions from a computer system carrying such data.
An offence against a State information system or critical infrastructure, or an offence committed in an organized group, is punished more heavily still: up to twenty-five years' criminal detention and a fine of up to 500,000,000 FCFA. A legal person additionally faces dissolution, a temporary or permanent bar on operating, closure of an establishment, or exclusion from public tenders, where it diverted its purpose to commit the offence.
The law replaced ordonnance n°15/PR/2018 du 23 février 2018 on the same subject, and gave every person and entity it reaches six months from its entry into force to come into compliance.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .