GambiaInformation and Communications Act, 2009, Computer Misuse and Cyber Crime part
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not cause a computer system to perform any function to secure access to a program or data without the right or permission of the person who controls that system.NIST AI RMFMAP 4.1
- Do not intercept, or cause to be intercepted, any function of or data within a computer system without the consent of both the sender and the intended recipient of the data, or a statutory power to do so.NIST AI RMFMAP 4.1
- Do not modify data held in a computer system, or degrade, interrupt, or deny access to a computer system, without lawful authority or excuse.no control in the NIST AI RMF
- Do not manufacture, sell, import, distribute, or possess a device or data designed or adapted primarily to commit an offence under this Part.no control in the NIST AI RMF
- Do not disclose a password or access code to a computer system or data for a wrongful purpose.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorised access to computer data (s. 163), access with intent to commit a further offence (s. 164), unauthorised access to and interception of a computer service (s. 165), unauthorised modification of computer material (s. 166), damaging or denying access to a computer system (s. 167), unlawful possession of devices and data (s. 168), and unauthorised disclosure of a password (s. 169) each carry, for an individual, a fine of 200,000 Dalasis or imprisonment for a term not exceeding five years, or both; a body corporate faces a fine of not less than 500,000 Dalasis. Where an offence under s. 166 impairs the operation of the computer system or suppresses or modifies data held in it, a further fine of 500,000 Dalasis applies.
Penalty structure
The 200,000 Dalasi figure is the individual offender's fixed ceiling (alongside up to five years' imprisonment) common to ss. 163-169. A body corporate instead faces a floor rather than a ceiling, a fine of not less than 500,000 Dalasis; s. 166 adds an aggravated further fine.
- Rule
- Fixed only
- As of
- Currency
- GMD
- Fixed cap
- 200,000
Who enforces it
Settledness
- As of
- Open questions
- Does automated retrieval of a web page the operator serves to any visitor count as access that is unauthorized under section 163(3) of the Information and Communications Act, 2009, which asks whether the person has consent to access "of the kind in question" from "any person who is so entitled"?
What it makes you log
Logging duty
Sections 163 to 169 punish unauthorized access to computer data, access with intent to commit an offence, access to and interception of a computer service, unauthorized modification, damaging or denying access to a system, possession of devices and data, and disclosure of a password. None requires a log or record to be made, kept, produced or reviewed. The Part states no territorial or jurisdiction clause for these offences.
- Kind
- None
- As of
What this law does
A person who causes a computer system to perform a function knowing that the access is unauthorised commits an offence, unless the person has a right to control the operation or use of the computer system and exercises that right.
Securing access to a computer system for the purpose of obtaining a computer service, or intercepting any function of or data within a computer system, is also an offence unless both the sender and intended recipient of the data have given consent or the actor is exercising a statutory power.
Causing an unauthorised modification of data held in a computer system, or, without lawful authority or excuse, degrading, interrupting, or denying access to a computer system or the data held in it, are each separate offences.
Manufacturing, selling, importing, distributing, or possessing a device or data designed or adapted primarily to commit any of these offences is itself an offence, as is knowingly disclosing a password or access code for wrongful gain, an unlawful purpose, or knowing it is likely to cause prejudice. It is immaterial to any of these offences whether the access or interception was directed at a particular program or data, or at any program or data at all.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .