KiribatiCybercrime Act 2021, unauthorised access
Cybercrime Act 2021 (No. 10 of 2021), s. 7 (Unauthorised access)
A computer misuse rule binding public and private bodies.
- Enforcement body
- Cybercrime Unit, Kiribati Police Service
- How the hook was established
- express
- What makes it apply
- User location
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer program or computer data held in a computer system unless you are entitled to control that kind of access, or have the consent of a person who is so entitled.
- Whether reading a public, unauthenticated page counts as access of a kind the operator has not consented to has not been settled by a reported Kiribati decision.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine not exceeding $10,000 or imprisonment not exceeding 7 years, or both, on conviction (s. 7(2)).
Penalty structure
Fine only; the same subsection also allows imprisonment of up to 7 years instead of or in addition to the fine. Kiribati has no currency of its own; the Australian dollar is the currency it uses.
- Rule
- Fixed only
- As of
- Currency
- AUD
- Fixed cap
- 10,000
What it makes you log
Logging duty
Section 7 defines unauthorised access to a computer program or data and makes knowingly or recklessly causing a computer system to perform a function to secure such access an offence punishable by a fine of up to $10,000 or imprisonment of up to seven years. It imposes no duty to create, keep, produce or review a log or record. The Act's procedural preservation powers (section 25, up to 60 days on a police notice) lie outside the cited section and are not read into this row.
- Kind
- None
- As of
What this law does
Section 7 makes access of any kind to a computer program or computer data held in a computer system illegal or unauthorised if the accessing person is not entitled to control access of that kind and does not have the consent of a person who is so entitled. A person who knowingly, or recklessly and without authority, causes a computer system to perform a function to secure such access is liable on conviction to a fine not exceeding $10,000 or imprisonment not exceeding 7 years, or both.
The Act applies to an act or omission in Kiribati's territory, on a Kiribati-registered ship or aircraft, or to a Kiribati national's conduct outside Kiribati where that conduct would also be an offence where it occurred. A Cybercrime Unit within the Kiribati Police Service administers the Act. The Act was assented to by the Beretitenti and states that it commences on a date the Minister appoints by notice; no commencement notice has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .