SwedenBrottsbalken 4 kap. 9 c §, Unauthorized Computer Access (Dataintrång)
Brottsbalk (1962:700) 4 kap. 9 c §
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not unlawfully gain access to, alter, delete, block, or register information intended for automated processing in Sweden, or seriously disturb or hinder the use of such information by another similar unlawful means.
These lines are LexLint's reading of the law's text. Also read by: Högsta domstolen, dom den 1 april 2014 i mål B 517-13 (recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A fine or imprisonment of up to two years for the ordinary offence; imprisonment of one to eight years for a gross offence.
Who enforces it
Enforcement body
The Swedish Police Authority (Polismyndigheten) investigates and the Swedish Prosecution Authority (Åklagarmyndigheten) prosecutes offences under the Criminal Code; there is no specialized regulator for this offence.
Settledness
- As of
- Case link
- https://www.domstol.se/globalassets/filer/domstol/hogstadomstolen/avgoranden/2014/b-517-13.pdf
- Case citation
- Högsta domstolen, dom den 1 april 2014 i mål B 517-13
- Open questions
- Is the retrieval of data that an operator publishes to everyone done 'olovligen' under 4 kap. 9 c §, when the operator's terms forbid automated collection but no technical barrier is in place?
- Does the Supreme Court's reading of 'olovligen' as acting 'utan tillstånd av den som har rätt att förfoga över uppgiften', given in a case about a police officer's use of internal registers, extend to a scraper with no relationship to the operator?
What it makes you log
Logging duty
Chapter 4, section 9 c makes it an offence to gain access unlawfully to data intended for automated processing, or to change, erase, block or enter such data, or to disrupt its use. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Section 9 c of chapter 4 of the Criminal Code makes it an offence for a person to unlawfully gain access to information intended for automated processing, or to unlawfully alter, delete, block, or enter such information into a register, or to unlawfully and seriously disturb or hinder the use of such information by another similar means.
The ordinary offence carries a fine or imprisonment of up to two years; a gross offence carries imprisonment of one to eight years, with gravity assessed by whether the act caused serious damage, concerned a large volume of information, or was otherwise of a particularly dangerous nature.
The provision's trigger is unlawful access, not the circumvention of a security measure, so it reaches a broader range of conduct than a statute conditioned on defeating an access control, and its reach to a scraper reading a public, unauthenticated page has not been tested by a reported Swedish decision. Section 9 c's current wording took effect on under Lag (2026:1318), the most recent of several amendments since the offence was first added to the Criminal Code.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .