South AfricaCybercrimes Act, unlawful access and unlawful interception of data
Cybercrimes Act 19 of 2020, ss. 2 (unlawful access) and 3 (unlawful interception of data)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Audit expectation
- none
What it requires
- Do not unlawfully and intentionally access a computer system or data storage medium.
- Do not unlawfully and intentionally intercept data, or possess data known or reasonably suspected to have been unlawfully intercepted, without a satisfactory exculpatory account.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate these sections.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A contravention of section 2(1) or (2) carries a fine or imprisonment of up to five years, or both, and a contravention of section 3(1) or (2) carries a fine or imprisonment of up to ten years, or both (s. 19(1)-(2)); the Act leaves the fine amount to the convicting court rather than fixing a monetary cap.
What it makes you log
Logging duty
Sections 2 and 3 of the Cybercrimes Act make it an offence to unlawfully and intentionally access a computer system or data storage medium, and to unlawfully and intentionally intercept data. Neither requires anyone to create, keep, produce or review a log or record. Section 24 gives a court in the Republic jurisdiction over a Chapter 2 offence where the person charged is a company or body of persons in the Republic, or where the offence affects any person, public body or business in the Republic. Outside the cited sections, section 54 requires an electronic communications service provider or financial institution that becomes aware its service is involved in a specified offence to report it to the police within 72 hours where feasible and to preserve information that may assist the investigation, and sections 41 and 42 let a police official direct a person or provider to preserve data for 21 days and then for up to 90 days; the row cites only sections 2 and 3, so none of that is coded.
- Kind
- None
- As of
What this law does
Section 2 makes it an offence to unlawfully and intentionally perform an act in respect of a computer system or data storage medium that places a person in a position to commit an access, interception, or interference offence, and separately makes it an offence to unlawfully and intentionally access a computer system or data storage medium; a contravention carries a fine or imprisonment of up to five years under section 19(1).
Section 3 makes it an offence to unlawfully and intentionally intercept data, including electromagnetic emissions from a computer system carrying it, or to possess data known or reasonably suspected to have been unlawfully intercepted without a satisfactory exculpatory account; a contravention of section 3(1) or (2) carries a fine or imprisonment of up to ten years under section 19(2).
Both offences require the access or interception itself to be unlawful, so a plain reading does not by itself capture reading a public, unauthenticated page that defeats no access control. The Act's Schedule repealed sections 85 to 88 of the Electronic Communications and Transactions Act 25 of 2002, the earlier statute that had carried South Africa's computer-misuse offences.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .