in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law1 instrument, 1 in force
Research summary (157 words)
Afghanistan has no comprehensive personal-data-protection law, before or after the 2021 change of government. Before 2021 the 2004 Constitution supplied general communications privacy (Art. 37) and home inviolability (Art. 38) rights, which are bare constitutional rights: the Constitution creates no lawful-basis regime, data-subject rights, or supervisory structure.
The 2014/2018 Access to Information Law separately contained a privacy exemption (a ground for withholding disclosed information, not a private-sector processing duty). United Nations reports describe the 2004 Constitution as suspended by the de facto authorities.
A report of the United Nations Secretary-General dated recorded that the Constitution of 2004 "remained suspended, with no further clarity on the legal framework", and a United Nations compilation for the Human Rights Council dated records that, following the Taliban takeover, "the de facto authorities suspended the 2004 Constitution and all domestic legislation, creating a legal vacuum". This summary takes no position on whether those authorities are recognized.
Article 37, read verbatim in full, secures freedom and confidentiality of correspondence and communications of individuals, whether by letter, telephone, telegraph or other means, from state inspection absent authorization by law.
Article 38 makes personal residences immune from entry or search without the owner's permission or a court order, subject only to an evident crime exception under which the responsible official must still obtain a court order after the fact, within the time limit set by law. Neither article defines personal data, sets processing conditions, or establishes a supervisory authority; both are bare constitutional rights enforceable against the state rather than a comprehensive data protection regime.
A report of the United Nations Secretary-General dated recorded that the Constitution of 2004 "remained suspended, with no further clarity on the legal framework". A United Nations compilation for the Human Rights Council dated records that, following the Taliban takeover, "the de facto authorities suspended the 2004 Constitution and all domestic legislation, creating a legal vacuum".
Both reports describe the 2004 Constitution as suspended, not as repealed, and this row takes no position on whether the de facto authorities are recognized.
Afghanistan has no scraping-specific statute, so general law governs each dimension separately.
The Penal Code of Afghanistan (2017), Part Twelve, Chapter One, Article 852 punishes accessing a computer, program, or data of a computer system belonging to someone else without authorization, and the article states no requirement that the offender infringe a security measure to gain access; no reported Afghan case construes whether reading a public, unauthenticated page falls within or outside that term, so open-web crawling of a public page is unsettled rather than clearly permitted or clearly prohibited.
No Afghan court decision addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.
The Law Supporting the Rights of Authors, Composers, Artists and Researchers (Copyright Law), 2008 protects a broad range of works and lets a natural person reproduce a published work, including all or part of a database, without the author's authorization, but only for that person's own personal use; the Law has no text-and-data-mining exception reaching institutional or commercial use, and its Article 8 exclusion from protection does not separately name facts or the news of the day.
No provision here creates a sui generis database right distinct from the general copyright regime, and Afghanistan has no general personal-data-protection statute reaching a scraper's collection of personal data from a public Afghan webpage. No statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
Multiple independent outlets report that the Taliban administration promulgated a new Criminal Procedure Code and Penal Principles of Taliban Courts in January 2026 said to replace the prior penal architecture; no source locates that framework's text, and no formal repeal of the 2017 Penal Code's cybercrime chapter has been located, so it remains in effect on that basis.
Article 851 defines a cybercrime as a crime committed through modern information technology, electronic communications, or the internet in cyberspace.
Article 852 punishes a person who accesses a computer, program, or data of a computer system belonging to someone else without authorization with short imprisonment, with an additional penalty where the access causes physical, non-physical, or financial damage; the article states no requirement that the offender circumvent a security measure to gain access.
Articles 853, 854, 856, 857, 858, and 859 each punish, with medium imprisonment or a cash fine of 60,000 to 300,000 Afghanis, unauthorized alteration of a computer system's functionality (including installing a virus or unauthorized hacking of network traffic), unauthorized destruction of a computer system, program, or data, unauthorized hijacking that prevents data transmission, producing or supplying software or a password for use in one of these offenses, electronic forgery of a computer's original setting, and electronic deception to access a computer system, program, or data.
Article 855 separately punishes disclosing a password, access code, or other means of access to a program, computer system, or data without authorization, with a cash fine equal to twice the benefit gained or loss inflicted. Article 916 ties the Penal Code's entry into force to nine months after its publication in the Official Gazette. The Gazette published the Code as issue number 1260 on .
The Ministry of Justice's own chronological list of the Official Gazette records the Code as issue No. 1260, dated 1396/2/25 in the Afghan solar calendar, with the status in force and a commencement nine months after publication in the Official Gazette, and records an addition to Article 916 published in issue No. 1286.
Afghanistan has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability.
The Law Supporting the Rights of Authors, Composers, Artists and Researchers (Copyright Law), 2008, Article 42 lets the press or other information media publish, without the author's authorization, speeches, lectures, legal proceedings, or similar works already displayed openly to the public, provided the author's name is indicated; the provision does not reach a competitor publisher's own news reporting the way a headline or snippet press-review exception would, and no reported Afghan decision applies it to a systematic news aggregator.
The Copyright Law's Article 8 does not separately exclude facts or the news of the day from protection, unlike some neighbouring statutes, and the Law predates the concept of a machine-readable text-and-data-mining reservation entirely, so no opt-out mechanism of that kind exists.
Law Supporting the Rights of Authors Composers, Artists and Researchers (Copyright Law), 2008 (Decree No. 54), art. 42 (Public Broadcasting of Work)Law Supporting the Rights of Authors
In force.Binds public and private bodies.
What this law does
Article 42 lets the press or other information media publish, without the author's authorization, speeches, lectures, legal proceedings, or similar works displayed openly to the public, provided the author's name is clearly indicated; the provision is narrower than a general press-review or quotation exception because it reaches only material already displayed openly to the public, such as a public address or a court proceeding, rather than a competitor publisher's own news reporting.
Article 8 excludes from protection any work that is in contradiction with the provisions of the Law, and denies protection to the copyright in preexisting material embedded in a derivative work, but it does not separately exclude facts or the news of the day the way some neighbouring statutes do.
Article 39(1) permits a natural person to reproduce a published work, including reproducing all or part of a database digitally, without the author's authorization, but only for that person's own personal use, so this exception does not reach an aggregator's systematic, publicly distributed reproduction. Article 49 ties the Law's entry into force to its publication in the Official Gazette.
The Ministry of Justice's contents list for the Official Gazette records the Law in issue No. 956, published on 1387/05/05 in the Afghan solar calendar. No Gregorian date for that publication has been located.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Afghanistan has no AI-transparency, AI-risk-obligation, AI-training-data, AI-prohibited-practice, AI-governance, or AI-sector-specific statute, regulation, or published national strategy addressing artificial intelligence, before or after the 2021 change of government.
The corpus's legacy derivation carries four candidates for Afghanistan under this topic: an Access to Information Law (2014, amended 2018), a Telecommunications Services Regulation Act (2005), and two records of the Penal Code's 2017 cybercrime chapter under different citations.
Each is a general government-transparency, sectoral telecommunications-confidentiality, or computer-misuse instrument that predates any AI-specific framework and imposes no AI-transparency, output-labeling, or other AI-system-specific duty; the cybercrime chapter's computer-misuse duty is filed under the scraping topic instead.
As of .
Cybersecurity law
No product-security-requirements statute, no dedicated vulnerability-or-incident-reporting duty running to a software or platform provider, and no general reasonable-security baseline statute reaching a business that holds covered data was confirmed in the primary text.
The Penal Code (2017), Part Twelve, Chapter One names a set of cybercrimes: Article 851 states that cybercrimes are crimes committed through modern information technology and electronic communications or internet in cyberspace, and the chapter's other articles punish unauthorized access, internet theft (a person who steals internet services of another is sentenced to a cash fine equal to twofold the value of stolen internet services), and cyber terrorism.
Every one of these offences is committed against a system or a service by an intruder rather than a duty placed on a product's manufacturer or a service's operator, so the chapter belongs to this jurisdiction's computer-misuse finding rather than to this one, and it is catalogued there rather than here.
On 4 and the Taliban administration promulgated a wholly new Criminal Procedure Code and Penal Principles of Taliban Courts, effective immediately with no public consultation, which this jurisdiction's own privacy-topic record already establishes as reported by multiple outlets to replace the prior penal architecture; that framework's text is unpublished, so whether it touches the 2017 Penal Code's cybercrime chapter, repeals it, or adds anything within this topic's scope is unconfirmed rather than assumed either way.
A Law on Electronic Transactions and Digital Signature and a Law Regulating Telecommunications Services, both officially gazetted, are held in the Ministry of Communications and Information Technology's own published document repository, alongside dozens of other ministry policies and statutes.
Both were retrieved from that repository at a page that answered successfully, but the Dari-script body text of each extracts in scrambled word order rather than legible sentences, to the point that even common words such as services cannot be located anywhere within either extracted text, confirmed independently across the two separate instruments from the same publisher rather than a single bad file.
No specific article or provision of either law, including whatever duties either may place on a licensed certification authority or a telecommunications licensee, of the kind other jurisdictions in this corpus record for their own Electronic Transactions statutes, can be confirmed from the text obtained here. Their titles, official-gazette publication, and hosting location are established; their operative content is not.
A National Cybersecurity Strategy of Afghanistan, dated November 2014 and also held in the Ministry's repository, is a policy document rather than a binding instrument: its own vision statement is to establish and achieve a Safe - Secure and Resilient cyber space for the government, businesses and citizens of Afghanistan, and its numbered action items are phrased throughout as recommendations, for example to encourage both public and private sector to assign a member of senior management as Chief Security Officer, giving them the responsibility of cybersecurity efforts and initiatives in the country, ensuring public private partnership, with no penalty, reporting clock, or enforcement mechanism attached to any of them.
The strategy records that the Ministry established the first Cyber Emergency Response Team in Afghanistan in 2009, officially named AFCERT, and that an internal Information Systems Security Directorate coordinated the strategy's drafting.
The strategy predates the 2021 change of government by seven years and nothing located confirms that it, or the institutions it describes, remain operative: the domain that the strategy associates with AFCERT does not currently resolve, and the telecommunications regulator's own website returns only a JavaScript application shell that could not be rendered into readable text under repeated attempts.
No cybersecurity, cyber-resilience, or IT-risk guidance for banks or payment-system operators was located on the central bank's own website, which carries no visible reference to either subject on the page retrieved. No enforcement record, published penalty, or private right of action for any security-shaped duty was located, because no instrument confirmed here creates one.
Afghanistan has no comprehensive personal-data-protection statute, already the privacy topic's finding for this jurisdiction, so there is no breach-notification statute here to point to as this jurisdiction's privacy row.
As of .
Age gating law
Afghanistan has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.
The Law on Mass Media (2006 version), which regulates print, broadcast, and audio-visual media licensing, contains a general prohibition (Chapter Eight) on publishing material contrary to the principles of Islam or defamatory of individuals, but neither that chapter nor any other provision names minors, sets an age threshold, or conditions a service's access on age verification.
The Penal Code of Afghanistan (2017) separately criminalises producing, presenting, broadcasting, or keeping pornography in cyberspace (art. 874) and displaying an immoral material depicting nudity (art. 867, exempting scientific use), but both are blanket criminal prohibitions applicable to any person rather than an age-verification or age-gating duty conditioning a service's access by the user's age.
As of .
Case law
No current case law for Afghanistan AI law
No current case law for Afghanistan privacy law
No current case law for Afghanistan scraping law
No current case law for Afghanistan cybersecurity law
No current case law for Afghanistan communications law
No current case law for Afghanistan content moderation law
No current case law for Afghanistan product and AI liability law
No current case law for Afghanistan digital accessibility law
No current case law for Afghanistan age gating law
No current case law for Afghanistan reuse law
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
