EswatiniComputer Crime and Cybercrime Act, 2022, Illegal Access
Computer Crime and Cybercrime Act, 2022 (Act No. 6 of 2022), s. 3 (Illegal Access)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location, Place of effect
- Audit expectation
- none
What it requires
- Do not access the whole or any part of a computer system without lawful excuse or justification; logging into a system you are not entitled to use is itself an offence under this Act, even before any security measure is defeated.
- Do not infringe a security measure to obtain computer data once inside a system, which raises the penalty for the access itself.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 3(1): a fine of up to E300,000 or imprisonment of up to three years, or both, for accessing a computer system without lawful excuse or justification. Section 3(2) raises this to a fine of up to E500,000 or imprisonment of up to five years, or both, where the access also infringes a security measure to obtain computer data.
Penalty structure
Section 3(1)'s base offence (access without lawful excuse or justification, no security measure infringed) caps at a fine of E300,000 or imprisonment of three years, or both. Section 3(2)'s aggravated offence (access that also infringes a security measure to obtain data) caps at a fine of E500,000 or imprisonment of five years, or both; the higher amount is the aggravated tier's.
- Rule
- Fixed only
- As of
- Currency
- SZL
- Fixed cap
- 500,000
What it makes you log
Logging duty
Section 3 makes it an offence to access a computer system, meaning to log into it, without lawful excuse or justification, and section 3(2) raises the penalty where a security measure is infringed to obtain computer data. It imposes no duty to create, keep, produce or review a log or record. The Act's procedural part is outside the cited section and not taken into the row: section 36 lets a law enforcement agent require, by written notice, that specified computer data be preserved for up to 28 days, and section 35 provides for production orders. Section 31 is the Act's own jurisdiction clause for any offence under the Act: it reaches acts committed wholly or in part within Eswatini and offences committed within or outside Eswatini with direct impact to it. Its limb for equipment, software or data located in Eswatini turns on where the system sits and carries no hook value.
- Kind
- None
- As of
What this law does
Section 3(1) makes it an offence, without needing to defeat any security measure, for a person to intentionally access the whole or any part of a computer system "without lawful excuse or justification," carrying a fine of up to E300,000 or imprisonment of up to three years, or both; "access" is defined at s. 2, in relation to this section only, as "logging into a computer system," so a plain reading does not reach merely retrieving a public, unauthenticated page without logging in.
Section 3(2) raises the penalty to a fine of up to E500,000 or imprisonment of up to five years, or both, where the person accessing under subsection (1) also infringes a security measure with intent to obtain computer data.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .