IndonesiaCriminal Code (KUHP), Article 332, unauthorised access to a computer or electronic system, as reworded by Law No. 1 of 2026
Law No. 1 of 2023, Article 332, Criminal Code (KUHP)
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access another person's computer or electronic system without right or unlawfully, or access any computer or electronic system without right or unlawfully in order to obtain electronic information or documents from it.
- A higher penalty tier applies where the access violates, breaks through, exceeds or breaches a security system.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 332 makes each paragraph a separate offence: paragraph (1) up to 6 years' imprisonment or a fine of up to category V (Rp500,000,000); paragraph (2) up to 7 years' imprisonment or a fine of up to category V (Rp500,000,000); paragraph (3), access that defeats a security system, up to 8 years' imprisonment or a fine of up to category VI (Rp2,000,000,000).
Penalty structure
Article 79(1) of the Criminal Code fixes the maximum fine for category VI at Rp2,000,000,000 and for category V at Rp500,000,000. The cap recorded here is the category VI amount. Article 79(2) provides that a Government Regulation sets the amounts if the value of money changes.
- Rule
- Fixed only
- As of
- Currency
- IDR
- Fixed cap
- 2,000,000,000
What record it asks for
Logging duty
Article 332 of the Criminal Code, as restated by Law No. 1 of 2026, punishes accessing a computer or electronic system without right or unlawfully, in three escalating forms. It imposes no duty to create, keep, produce or review a log or record. The Code's general territorial articles are not invoked by article 332, so no hook is read from them.
- Kind
- None
- As of
What this law does
Article 332 of the Criminal Code (Law No. 1 of 2023), as reworded by Law No. 1 of 2026, punishes three escalating forms of accessing a computer or electronic system without right or unlawfully: paragraph (1), accessing another person's computer or electronic system by any means, by up to six years' imprisonment or a fine of up to category V; paragraph (2), accessing a computer or electronic system by any means in order to obtain electronic information or documents, by up to seven years' imprisonment or a fine of up to category V; and paragraph (3), accessing a computer or electronic system by any means by violating, breaking through, exceeding or breaching a security system, by up to eight years' imprisonment or a fine of up to category VI.
Article 79(1) of the Criminal Code fixes the maximum fine for category V at Rp500,000,000 and for category VI at Rp2,000,000,000, and article 79(2) provides that a Government Regulation sets the amounts if the value of money changes. As first enacted, paragraphs (1) and (2) of article 332 each applied to a person who acted dengan sengaja dan tanpa hak atau melawan hukum (intentionally and without right or unlawfully).
Law No. 1 of 2026 restated all three paragraphs as applying to a person who acts tanpa hak atau melawan hukum (without right or unlawfully), with no express word for intentionally. Article 36(2) of the Criminal Code provides that a punishable offence is one committed intentionally, and that a negligent offence is punishable only where a law expressly says so.
The Criminal Code directs that references to articles 30 and 46 of the Electronic Information and Transactions Law are replaced by references to article 332. Law No. 1 of 2026 provides in its article IX that it takes effect on . Under its article 624, the Criminal Code takes effect three years after its promulgation.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .