JamaicaCybercrimes Act, 2015, unauthorised access to computer program or data
Cybercrimes Act, 2015 (Act 31 of 2015), s. 3
In force.
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location, Operator establishment
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not knowingly obtain, for yourself or another person, access to any program or data held in a computer unless you are entitled to control that access or have the consent of a person who is so entitled.
- No reported Jamaican decision has held that reading a public, unauthenticated page without defeating any access control falls within this offence, but the statute's consent-based test does not itself exempt public pages.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
On summary conviction before a Resident Magistrate: a fine not exceeding JMD 3,000,000 or imprisonment not exceeding three years for a first offence, up to JMD 4,000,000 or four years where damage is caused, and up to JMD 5,000,000 or five years for a second or subsequent offence (s. 3(3)(a)). On indictment before a Circuit Court: imprisonment up to seven years for a first offence, ten years where damage is caused, and fifteen years for a second or subsequent offence, with an unspecified fine at each tier (s. 3(3)(b)). A sentencing court may separately order the convicted person to pay compensation to anyone who suffered loss (s. 15).
Penalty structure
Highest summary-conviction fine, for a second or subsequent offence (s. 3(3)(a)(iii)). A first offence caps at JMD 3,000,000 and a first offence causing damage at JMD 4,000,000. On indictment before a Circuit Court the fine is unspecified and imprisonment may reach fifteen years for a second or subsequent offence (s. 3(3)(b)).
- Rule
- Fixed only
- As of
- Currency
- JMD
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Jamaica Constabulary Force, prosecuted before a Resident Magistrate or, on indictment, a Circuit Court
What it makes you log
Logging duty
Section 3 makes knowingly obtaining unauthorised access to a program or data held in a computer an offence. It imposes no duty to create, keep, produce or review a log or record. The Act's own application section, section 22, reaches conduct wholly or partly in Jamaica and conduct outside Jamaica attributable to a Jamaican national, including a company constituted in Jamaica; its further limb for conduct outside Jamaica that affects a computer or data in Jamaica turns on where the computer sits and carries no hook value. The Act's preservation power (section 17, up to sixty days on a constable's notice) lies outside the cited section and is not read into this row.
- Kind
- None
- As of
What this law does
Section 3(1) makes it an offence to knowingly obtain, for oneself or another person, any unauthorised access to a program or data held in a computer. Section 2(4) defines access as without authorisation whenever the person is not themselves entitled to control the access and does not have the consent of a person who is so entitled, without requiring that the person defeat a technical security measure, a broader trigger than Kenya's or several other jurisdictions' formulations.
Section 3(3) tiers the offence by forum and repeat conduct: on summary conviction before a Resident Magistrate, a fine not exceeding JMD 3,000,000 or imprisonment not exceeding three years for a first offence, rising to JMD 4,000,000 or four years where damage is caused, and JMD 5,000,000 or five years for a second or subsequent offence; on indictment before a Circuit Court, imprisonment alone up to seven, ten, or fifteen years across the same three tiers, with the fine left unspecified.
Section 15 lets the sentencing court, in the same criminal proceedings, order the convicted person to pay compensation to anyone who suffered loss from the offence, without prejudice to any other cause of action the victim may separately have; this is a court-ordered ancillary remedy rather than a freestanding civil claim. This Act repealed and replaced the Cybercrimes Act, 2010. No statement of the day the Act came into operation has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .