KuwaitElectronic Transactions Law, Unauthorised Access to an Electronic Data Processing System
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not illegitimately log in to an electronic data processing system, prevent access to it, damage it, or obtain credit-card or other electronic-card numbers from it to steal funds.
- Reading a public, unauthenticated page without illegitimately logging in to a system, preventing access to it, or damaging it has not itself been held to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of up to three years and a fine of between five thousand and twenty thousand Kuwaiti dinars, or either penalty, on conviction under art. 37.
Penalty structure
Fine of not less than five thousand and not exceeding twenty thousand Kuwaiti dinars under art. 37; the same clause permits imprisonment of up to three years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- KWD
- Fixed cap
- 20,000
What it makes you log
Logging duty
Article 37 punishes illegitimate log-in to or damage of an electronic data processing system, issuing an authentication certificate without a licence, damaging or forging an electronic signature, document or record, knowingly using a defective or false one, unlawfully accessing a signature, system, document or record, and breaching Article 32 and items A and B of the first paragraph of Article 35 (the bars on government bodies unlawfully accessing or disclosing personal data and on collecting or using it unlawfully). The Article imposes no duty to create, keep, produce or review a log or record, and names no territorial hook. The Law's separate electronic-record retention article is outside the Article this row cites and is not part of this row.
- Kind
- None
- As of
What this law does
Article 37 criminalises, for any person, deliberately and illegitimately logging in to an electronic data processing system, preventing access to it, causing it damage, or obtaining credit-card or other electronic-card numbers from it to steal funds, alongside separate clauses on unlicensed electronic-authentication services and forged or defective electronic signatures.
The offence carries imprisonment of up to three years and a fine of between five thousand and twenty thousand Kuwaiti dinars, or either penalty. The public prosecution alone has jurisdiction to investigate and pursue the offence, so it creates no private civil claim. Article 46 provides that the Law is published and takes effect from the date the executive regulation is approved, and no official source for that approval date has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .