GuineaLoi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif aux infractions informatiques (cybercriminalité)
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
What it requires
- Do not access, or continue to access, a computer system without right; a heavier penalty applies where the access hinders the system's operation.NIST AI RMFMAP 4.1
- Do not fraudulently intercept data.NIST AI RMFMAP 4.1
- Do not produce, disseminate, or distribute child pornography.NIST AI RMFMAP 3.3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
One to five years' imprisonment and a fine of 60,000,000 to 130,000,000 Guinean francs for unauthorized access to a computer system; three to six years and 100,000,000 to 500,000,000 Guinean francs for hindering a computer system's operation; five to ten years and 500,000,000 to 1,000,000,000 Guinean francs for fraudulent interception of data; and penalties reaching up to ten years' imprisonment for child pornography.
Penalty structure
Base band for unauthorized access to a computer system. Other offenses in the same statute carry their own, higher bands: 100,000,000 to 500,000,000 Guinean francs for hindering a computer system's operation, and 500,000,000 to 1,000,000,000 Guinean francs for fraudulent interception of data, each alongside a longer prison term. The government source describing these penalties does not give a separate fine figure for the child-pornography offense.
- Rule
- Fixed only
- As of
- Minimum
- 60,000,000
- Currency
- GNF
- Fixed cap
- 130,000,000
Who enforces it
Enforcement body
Guinean public prosecution and the criminal courts
Settledness
- As of
- Open questions
- Does "accède ou tente d'accéder frauduleusement à tout ou partie d'un système informatique" ("accesses or attempts to access, fraudulently, all or part of a computer system") in Article 4 of the cybercrime title reach an automated retrieval of web pages that the system's operator serves to the public, and what makes an access "frauduleusement" ("fraudulently") where no access control is defeated?
- Does the reach of Article 3 of the cybercrime title to offences "commises sur le territoire de la République de Guinée" ("committed in the territory of the Republic of Guinea") cover a crawler operated from outside Guinea that accesses a computer system hosted in Guinea?
What this law does
Guinea's cybersecurity and personal-data protection statute, Loi n° L/2016/037/AN, punishes unauthorized access to a computer system with one to five years of imprisonment and a fine of 60,000,000 to 130,000,000 Guinean francs. It punishes hindering the operation of computer systems with three to six years of imprisonment and a fine of 100,000,000 to 500,000,000 Guinean francs.
It punishes the fraudulent interception of data with five to ten years of imprisonment and a fine of 500,000,000 to 1,000,000,000 Guinean francs. It punishes child pornography with penalties reaching up to ten years of imprisonment. The statute reaches every cybercrime offense committed on Guinean territory. It also reaches an offense whose prosecution requires the collection of electronic evidence.
Guinea's own cybersecurity agency does not itself state how unauthorized access is read for a publicly accessible, unauthenticated web page, and no Guinean court decision construing that question is reported. No separate statute or case law addressing terms-of-service enforceability, browsewrap versus clickwrap formation, or the effect of a login or a terms acceptance is reported. No commencement notice for the statute has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .