ZambiaCyber Crimes Act, 2025, unauthorised access to computer system and data
Cyber Crimes Act, 2025 (Act No. 4 of 2025), s. 3
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not infringe a security measure to access or monitor a computer system, or any part of one, belonging to another person without lawful authority or in excess of authority.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this section.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of up to five hundred thousand penalty units (ZMW 200,000) or imprisonment of up to five years, or both, on conviction (s. 3(2)).
Penalty structure
Stated in the Act as five hundred thousand penalty units, valued at ZMW 0.40 each under the Fees and Fines (Fee and Penalty Unit Value) (Amendment) Regulations, 2024; the same subsection also allows imprisonment of up to five years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- ZMW
- Fixed cap
- 200,000
What it makes you log
Logging duty
Section 3(1) of the Cyber Crimes Act, 2025 forbids intentionally and without lawful authority, or in excess of authority, infringing a security measure, or accessing or monitoring another person's computer system or any part of it; section 3(2) sets the penalty. It requires no one to create, keep, produce or review a log or record, and the Act has no territorial clause. Outside the cited section, section 30 lets a law enforcement officer require a person in control of computer data to preserve it for up to seven days, and a judge or magistrate may order longer preservation, while sections 31 and 32 provide for disclosure and collection of traffic data under a warrant or order; the row cites only section 3, so none of that is coded.
- Kind
- None
- As of
What this law does
Section 3(1) prohibits intentionally and without lawful authority or in excess of authority, infringing a security measure to access or monitor a computer system, or any part of a computer system, of another person. Contravention carries a fine of up to five hundred thousand penalty units, valued at ZMW 0.40 each since (ZMW 200,000), or imprisonment of up to five years, or both.
Because the offence's trigger is infringing a security measure, a person who reads a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision. This section narrows the unauthorised-access offence it replaced: section 49 of the repealed Cyber Security and Cyber Crimes Act, 2021 penalised accessing or intercepting data without authority or exceeding authorised access, with no express requirement to infringe a security measure.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .