HondurasCódigo Penal, seguridad de las redes y de los sistemas informáticos
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system, in whole or in part, by infringing a security measure established to prevent it, without authorization.NIST AI RMFMAP 4.1
- Do not introduce, delete, alter or suppress computer data, or disable a computer system's operation, without authorization.no control in the NIST AI RMF
- Reading a public, unauthenticated page that defeats no access control has not itself been held to violate this offence.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Six to eighteen months' imprisonment, or a fine of 100 to 200 day-fines, for unauthorized access to a computer system by infringing a security measure (art. 398). One to two years' imprisonment, or a fine of up to 300 day-fines, for unauthorized introduction, deletion, alteration or suppression of computer data, and one to three years' imprisonment, or a fine of up to 400 day-fines, for disabling a system's operation (art. 399). Six months to one year's imprisonment, or a fine of up to 200 day-fines, for the device-abuse offence (art. 400); the same range, or a fine of up to 300 day-fines, for technology-facilitated identity theft (art. 401). Every penalty in this title is increased by a third for critical-infrastructure or grave-economic-damage aggravations (arts. 398, 399) and again by a third, with professional disqualification (absolute disqualification for a public official), where the offender is the system's administrator or an authorized user, or belongs to an organized criminal group (art. 402). A legal person responsible for one of these offences faces three to five years' suspension of its specific activities and a fine of 300 to 500 day-fines (art. 403). Each day-fine is worth not less than twenty Lempiras (L.20) nor more than five thousand Lempiras (L.5,000), set by the court according to the convicted person's economic situation (art. 53).
Penalty structure
Article 398's fine is 100 to 200 day-fines; article 53 fixes each day-fine's value between L.20 and L.5,000, set by the sentencing court from the convicted person's economic situation. The maximum and minimum fines are the arithmetic extremes (200 x L.5,000 and 100 x L.20) for the unauthorized-access offence specifically; the damage offence in article 399 carries a wider day-fine range (up to 400 days).
- Rule
- Fixed only
- As of
- Minimum
- 2,000
- Currency
- HNL
- Fixed cap
- 1,000,000
What it makes you log
Logging duty
Articles 398 to 405 define offences of unauthorized access to computer systems, damage to data and systems, abuse of devices and identity impersonation, with aggravations, liability of legal persons, a jurisdiction rule and definitions. They impose no duty to create, keep, produce or review a log or record. Article 404 reaches offences carried out in Honduras even against systems abroad, and offences against systems located in Honduras even when the offender acted from abroad; the second limb turns on where the system sits and is read as an effect in Honduras.
- Kind
- None
- As of
What this law does
Article 398 punishes with six to eighteen months' imprisonment or a fine of 100 to 200 day-fines whoever, infringing the security measures established to prevent it, accesses all or part of a computer system without authorization, with the penalty increased by a third where the system concerns critical community infrastructure.
Article 399 punishes unauthorized introduction, deletion, deterioration, alteration, suppression or serious disabling of computer data with one to two years' imprisonment or a fine of 100 to 300 day-fines, and unauthorized disabling of a computer system's operation with one to three years' imprisonment or a fine of 100 to 400 day-fines, with both penalties increased by a third where the conduct causes grave economic damage or affects critical community infrastructure.
Article 400 punishes manufacturing, importing, selling, facilitating or obtaining devices, software, passwords or access codes intended for committing these offences with six months to one year's imprisonment or a fine of 100 to 200 day-fines, and article 401 punishes identity theft carried out through information and communication technology with fraudulent intent with the same six-months-to-one-year imprisonment range or a fine of 100 to 300 day-fines.
Article 402 raises every penalty in this title by a third where the offender is responsible for or authorized to access the system, or belongs to an organized criminal group, and adds professional disqualification, with absolute disqualification for a public official. Article 403 punishes a legal person responsible for one of these offences with three to five years' suspension of its specific activities and a fine of 300 to 500 day-fines.
Article 404 gives Honduran courts jurisdiction over these offences when committed in Honduras against a system located abroad, or against a system located in Honduras from abroad. Because the article 398 offence turns on infringing a security measure, accessing a public, unauthenticated page that defeats no access control falls outside a plain reading of the provision.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .