SenegalLoi n° 2008-11 du 25 janvier 2008 sur la Cybercriminalité, unauthorized computer-system access (Penal Code arts. 431-8 to 431-9)
Loi n° 2008-11 du 25 janvier 2008 portant sur la Cybercriminalité, Code pénal arts. 431-8 to 431-9
In force.
A computer misuse rule binding public and private bodies.
- Enforcement body
- Senegalese public prosecutor (ministère public), under the ordinary criminal courts
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or attempt to access, all or part of a computer system by fraudulent means, and do not maintain a fraudulent presence in one once inside.
- Reading a public, unauthenticated page without defeating a login or technical access control has not itself been held to violate this provision, but no reported Senegalese decision confirms it falls outside 'fraudulent access' either.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A prison term of six months to three years and/or a fine of 1,000,000 to 10,000,000 CFA francs on conviction (art. 431-8).
Penalty structure
Fine only; the same article also allows imprisonment of six months to three years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Minimum
- 1,000,000
- Currency
- XOF
- Fixed cap
- 10,000,000
What it makes you log
Logging duty
Articles 431-8 and 431-9 punish fraudulently accessing, or fraudulently remaining in, a computer system. They state no duty to create, keep, produce or review a log or record, and carry no territorial clause. The Act has a record-related provision outside the cited articles: article 431-44 punishes a person engaged in e-commerce activity who fails to retain the information required by article 4 of the Law on Electronic Transactions, and article 677-35 of the Code of Criminal Procedure lets an investigating judge order any person to preserve data under their control for up to two years.
- Kind
- None
- As of
What this law does
Article 431-8 punishes anyone who fraudulently accesses or attempts to access all or part of a computer system, and anyone who fraudulently obtains an advantage for himself or another by accessing one, with a prison term of six months to three years and/or a fine of 1,000,000 to 10,000,000 CFA francs; article 431-9 punishes fraudulently maintaining a presence in a system with the same penalty.
Unlike a neighbouring statute that limits the offense to access gained by infringing a security measure, article 431-8's English text carries no such express trigger, so whether reading a public, unauthenticated page without defeating any access control satisfies 'fraudulently accesses' has not been settled by a reported Senegalese decision.
Article 431-10 separately punishes obstructing or distorting a computer system's operation, with a prison term of one to five years and a fine of 5,000,000 to 10,000,000 CFA francs. Article 431-12 punishes fraudulently intercepting non-public data transmissions with the same range of penalties. Loi n° 2008-11 was promulgated on . It was published in Journal officiel n° 6406 of . The law's final articles state no day of its own for its entry into force.
Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .