Trinidad and TobagoComputer Misuse Act 2000, Unauthorised Access
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not cause a computer to perform a function to secure access to a program or data knowingly and without authority; authority turns on the consent of the person entitled to control access, not on whether a technical security measure was defeated.
- Reading a public, unauthenticated page has not itself been held to satisfy or fail this test, since no reported Trinidadian case has construed the authority element against a scraper of open web content.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of up to four years on a second or subsequent conviction (s. 3(1)), plus up to three years' additional imprisonment where damage results (s. 3(2)); an offence involving a protected computer carries up to ten years' imprisonment (s. 9).
Penalty structure
First conviction: fine of $15,000 and imprisonment for two years; second or subsequent conviction: fine of $30,000 and imprisonment for four years (s. 3(1)). Where damage results, an additional fine of $20,000 and imprisonment for three years applies (s. 3(2)). An offence involving a protected computer carries an enhanced penalty of $150,000 and imprisonment for ten years (s. 9).
- Rule
- Fixed only
- As of
- Currency
- TTD
- Fixed cap
- 30,000
What it makes you log
Logging duty
Section 3 makes it an offence to cause a computer to perform a function knowingly and without authority for the purpose of securing access to a program or data, with a further penalty where damage results. It imposes no duty to create, keep, produce or review a log or record. Section 12 reaches an offender outside the State where the accused was in the State, or the damage occurred within the State, at the material time; the limb that turns on where the computer, program or data sits carries no hook value. The police investigation powers in Part III are outside the section this row cites.
- Kind
- None
- As of
What this law does
Section 3(1) prohibits knowingly and without authority causing a computer to perform any function for the purpose of securing access to a program or data held in that computer or another one, on pain of a fine of $15,000 and imprisonment for two years, rising to $30,000 and four years on a second or subsequent conviction.
Section 2(2) defines access as unauthorised where the person is not entitled to control access of that kind and does not have the consent of the person who is; the offence does not require infringing a security measure, so it is drawn more broadly than a computer-misuse statute that turns on circumvention.
Section 3(2) adds a further fine and imprisonment where the access causes damage, and section 9 enhances the penalty to $150,000 and ten years' imprisonment where the offence involves a protected computer. No reported Trinidadian case construes whether reading a public, unauthenticated page without defeating any access control falls within the section absent the consent element being read narrowly.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .