QatarCybercrime Prevention Law, unauthorised access
Law No. 14 of 2014 (Cybercrime Prevention Law), arts. 2-4
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not intentionally and illegally access, exceed authorised access to, or knowingly continue accessing a Qatar-based website, information system, or information network once aware the access is unauthorised; a violation reaching a system belonging to a state authority or affiliated corporation carries a doubled penalty.
- Do not unlawfully capture, intercept, or spy on traffic data or data being transmitted through an information network while crawling or collecting it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 3's general unauthorised-access offence carries imprisonment of up to three years and a fine of up to QAR 500,000, doubled on aggravating grounds; article 2's parallel offence against a state-affiliated system carries the same base penalty and doubling; article 4's interception offence carries a lower ceiling of two years and QAR 100,000.
Penalty structure
Article 3 (general unauthorised access, exceeding authorised access, or continued access once known unauthorised) and article 2 (unauthorised access to a state-affiliated system) each carry imprisonment of up to three years and a fine of up to QAR 500,000, doubled to up to six years and QAR 1,000,000 where the access results in acquiring, disclosing, destroying, transferring, or republishing data. Article 4's separate interception offence carries a lower ceiling of imprisonment up to two years and a fine of up to QAR 100,000.
- Rule
- Fixed only
- As of
- Currency
- QAR
- Fixed cap
- 1,000,000
What it makes you log
Logging duty
Articles 2 to 4 create offences of unlawful access to a state body's website or information system, unlawful access or exceeding authorized access to any information system, and unlawful capture or interception of traffic data. They state offences and penalties and impose no duty to create, keep or produce a log or record, and name no territorial reach. Duties to keep data sit outside the cited articles: article 21(3) and (4) require a service provider to keep user information for a year and information technology data, traffic data and content information for 90 days, renewable on request of the competent body, and article 22(3) requires State bodies to keep information technology data and user data for not less than 120 days.
- Kind
- None
- As of
What this law does
Article 3 punishes any person who intentionally and illegally accesses a website, information system, information network, or information technology technique, exceeds authorised access, or knowingly continues to visit or access it once aware the access is unauthorised, with imprisonment of up to three years and a fine of up to QAR 500,000, doubled where the access results in acquiring, disclosing, destroying, or republishing data.
Article 2 imposes the same base penalty, doubled on the same grounds, for unlawful access specifically to a website or information system belonging to a state authority, body, entity, or affiliated corporation. Article 4 separately punishes unlawfully capturing, intercepting, or spying on traffic data or data in transit through an information network or technology technique, with a lower ceiling of two years and QAR 100,000.
The Law does not define 'unauthorised' by reference to a technical access control. Article 1 of the promulgating Law provides that the Cybercrime Prevention Law comes into force, without stating a day. No gazette notice stating the day has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .