TogoLoi n° 2018-026, accès et maintien frauduleux à un système informatique
Loi n° 2018-026 du 07 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité art. 8 (accès et maintien frauduleux à un système informatique)
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or remain present in, a computer system without right, including a system reached over the internet.
- Reading a public, unauthenticated page has not itself been held to violate this provision, but the statute does not expressly limit the offense to defeating a security measure.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Six months to two years' imprisonment and a fine of XOF 5,000,000 to XOF 20,000,000, or either penalty alone (art. 8, first paragraph); doubled if the access caused a serious disruption or interruption of the system, and raised to five years' imprisonment and XOF 15,000,000 to XOF 60,000,000 where the victim is the Togolese State.
Penalty structure
Base tier for a first offense against a non-State system; the same article doubles this fine (alongside the prison term) for a serious disruption, and sets a separate XOF 15,000,000 to XOF 60,000,000 range where the Togolese State is the victim.
- Rule
- Fixed only
- As of
- Minimum
- 5,000,000
- Currency
- XOF
- Fixed cap
- 20,000,000
What it makes you log
Logging duty
Article 8 punishes accessing or remaining in a computer system without right, with a doubled penalty for serious disruption and a higher one where the victim is the Togolese State (English as in the pinpoint above). It imposes no duty to create, keep, produce or review a log or record. The Act has no jurisdiction clause for its offences (its territory references are in the search and seizure articles of the procedure chapter), so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 8 punishes any person who, without right, accesses or attempts to access, or remains or attempts to remain, in all or part of a computer system, with six months to two years' imprisonment and a fine of XOF 5,000,000 to XOF 20,000,000, or either penalty alone. The penalty doubles where the access results in a serious disruption or interruption of the system.
It rises to five years' imprisonment and a fine of XOF 15,000,000 to XOF 60,000,000 where the offense is committed to the detriment of the Togolese State.
The provision's trigger is access without right rather than the circumvention of a security measure, so unlike a statute that requires infringing an access control, its plain text does not on its own resolve whether reading a public, unauthenticated page falls inside or outside the offense, and no reported Togolese decision has addressed the question.
Article 9 of the same law separately punishes destroying, hindering, falsifying, disrupting or interrupting the functioning of a computer system, and article 10 separately punishes introducing, deleting, altering, destroying, extracting or intercepting computerised data, each with three to five years' imprisonment and a fine of XOF 25,000,000 to XOF 100,000,000; both are aimed at interference with or extraction of data from a system rather than passive reading of a page it makes public.
Article 48, the closing article, leaves the manner of the law's application to implementing decrees and names no day of the law's own entry into force, and no commencement notice has been located in the Journal officiel.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .