MauritaniaLoi n° 2016-007, accès non autorisé à un système informatique
Loi n° 2016-007 du 20 janvier 2016 relative à la cybercriminalité, arts. 6-7 (accès non autorisé)
In force since .
A computer misuse rule binding public and private bodies.
- Enforcement body
- Mauritanian judicial authorities, per the general criminal procedure the law incorporates
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or attempt to access, all or part of a computer system intentionally and without right.
- Do not remain connected to all or part of a computer system after accessing it without right.
- Reading a public, unauthenticated page without defeating any technical access control has not itself been construed by a Mauritanian court as access without right.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
One to three years' imprisonment and a fine of 100,000 to 2,000,000 ouguiya, or either penalty alone, for accessing or attempting to access a computer system intentionally and without right (art. 6); two to four years' imprisonment and a fine of 200,000 to 3,000,000 ouguiya, or either penalty alone, for remaining connected to it in the same conditions (art. 7).
Penalty structure
Article 7's ceiling for remaining connected without right (200,000 to 3,000,000 ouguiya), the heavier of the two offences; article 6's unauthorised-access offence carries a lower fine band of 100,000 to 2,000,000 ouguiya. Both also carry imprisonment of up to four years instead of or alongside the fine. Amounts are stated in ouguiya as denominated before Mauritania's 2018 currency redenomination.
- Rule
- Fixed only
- As of
- Currency
- MRO
- Fixed cap
- 3,000,000
What it makes you log
Logging duty
Articles 6 and 7 create the offences of unauthorized access and of unauthorized remaining in a computer system, with imprisonment and a fine. They require no log or record. Article 48 gives the Mauritanian courts jurisdiction over an offence under the Law committed on national territory, one that harms State interests or has a Mauritanian-law victim, or one whose presumed author is on Mauritanian territory and is not extradited on grounds of nationality alone; that is the Law's own jurisdiction clause for its offences. The Law's data-preservation order (up to ninety days, chapter on procedure) is a judicial power outside articles 6 and 7 and is not read into this row.
- Kind
- None
- As of
What this law does
Article 6 punishes anyone who accesses or attempts to access, intentionally and without right, all or part of a computer system, with one to three years' imprisonment and a fine of 100,000 to 2,000,000 ouguiya, or either penalty alone. Article 7 punishes remaining, or attempting to remain, connected to all or part of a computer system in the same conditions with a heavier penalty of two to four years' imprisonment and a fine of 200,000 to 3,000,000 ouguiya, or either penalty alone.
Neither article states that the offence requires defeating a technical security measure to gain access, unlike some comparable statutes elsewhere; the standard is only that the access be intentional and without right, so a plain reading leaves open whether reading a public, unauthenticated page without any technical control to defeat counts as access without right, and no reported Mauritanian decision has construed the phrase.
Article 2 confines the statute to offences linked to the use of information and communication technologies and excludes sound and television broadcasting services from its scope. Article 52 ties the law's execution to publication in the Official Gazette, immediately after the President's promulgation dateline of .
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .