TaiwanCriminal Code, Offenses Against Computer Security
Criminal Code of the Republic of China (中華民國刑法), Arts. 358-363
In force.
A computer misuse rule binding public and private bodies.
- Enforcement body
- Public prosecutors and the courts, on the victim's complaint (Article 363)
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access another's computer or related equipment by entering someone else's password, defeating a technical protective measure, or exploiting a system vulnerability without cause; each is a separate ground for criminal exposure under Article 358.NIST AI RMFMAP 4.1
- Do not build or use a program whose purpose is committing one of the offenses in this chapter (Article 362).no control in the NIST AI RMF
- Accessing a page that imposes no password or technical protective measure has not been shown to fall within this chapter's access offense.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unauthorized computer access under Article 358 carries up to three years imprisonment and/or a fine up to NT$300,000; obtaining, deleting, or altering data under Article 359, and making a program to commit a chapter offense under Article 362, each carry up to five years imprisonment and/or a fine up to NT$600,000; offending against a public office's computer under Article 361 increases the punishment by up to one half.
Penalty structure
NT$600,000 is the highest per-article fine cap, shared by Articles 359 and 362; Article 358's cap is NT$300,000 and Article 360's is NT$300,000. Each fine is stated as an alternative to, or in addition to, imprisonment.
- Rule
- Fixed only
- As of
- Currency
- TWD
- Fixed cap
- 600,000
What it makes you log
Logging duty
Articles 358 to 362 make it an offence to gain access to another person's computer by a password, cracked protection or a system loophole, to obtain, delete or alter another person's magnetic record, to interfere with another person's computer, and to make computer programs for those offences; article 361 raises the penalty for a public office's computers and article 363 requires a complaint for articles 358 to 360. None imposes a duty to create, keep, produce or review a log or record, and none carries a territorial clause of its own; the Code's general articles on where it applies are not invoked by them.
- Kind
- None
- As of
What this law does
Chapter 36 criminalizes gaining access to another's computer or related equipment by entering another's password, cracking its protective measures, or exploiting a system loophole without cause (Article 358); obtaining, deleting, or altering another's computer data without cause and causing injury (Article 359); interfering with another's computer or related equipment through a computer program or other electromagnetic method without cause and causing injury (Article 360); and making a program specifically to commit one of those offenses (Article 362).
Offending against a public office's computer increases the punishment by up to one half (Article 361), and prosecution of the Article 358 through 360 offenses proceeds only upon the victim's complaint (Article 363).
Article 358 reaches access only by entering another person's password, cracking the protective measures for using the computer, or exploiting a loophole of the computer system, but Articles 359 and 360 contain no password, protective-measure, or loophole element and turn instead on acting without reason and causing injury to the public or another.
No commencement clause for the act of that added the chapter has been located, and no day on which the chapter came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .