Law / Afghanistan

Afghanistan

3 of 5 named instruments researched to a stage, across three of the six areas of law we track: 3 in force. As of 20 September 2026.

  1. AI law none researched
  2. Privacy law 1
  3. Scraping law 1
  4. Cybersecurity law none researched
  5. Age gating law none researched
  6. News aggregation law 1

in forceenacted but not yet in forceproposedrepealed, withdrawn or blocked

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Privacy law1 instrument, 1 in force

Research summary (214 words)

Afghanistan has no comprehensive personal-data-protection law, before or after the 2021 change of government.

Under the pre-2021, internationally recognized government, the 2004 Constitution supplied general communications privacy (Art. 37) and home inviolability (Art. 38) rights, confirmed at primary source and authored here as a bare constitutional-rights instrument, the same shape as Timor-Leste's and Palestine's constitutional privacy provisions elsewhere: it creates no lawful-basis regime, data-subject rights, or supervisory structure.

The 2014/2018 Access to Information Law separately contained a privacy exemption (a ground for withholding disclosed information, not a private-sector processing duty), confirmed at primary source but not authored as an instrument, since an exemption from disclosure is not itself a processing duty. The 2017 Penal Code's cybercrime chapter (Part Twelve, arts. 851-859) is catalogued under the scraping topic.

A significant recent development: on 4 and 7 January 2026 the Taliban administration promulgated a new Criminal Procedure Code and "Penal Principles of Taliban Courts" (119 articles), effective immediately with no public consultation, which multiple independent outlets describe as replacing the prior penal code and further undermining the 2004 Constitution's operative status.

That framework's text is unpublished, so its treatment of personal data is unknown, and no published instrument repeals or supersedes Articles 37 or 38, which is why the constitutional instrument above stays coded in effect.

Comprehensive regime

Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)

Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38Constitution of the Islamic Republic of Afghanistan

In force since 26 January 2004. Binds public and private bodies.

What this law does

Article 37, read verbatim in full, secures freedom and confidentiality of correspondence and communications of individuals, whether by letter, telephone, telegraph or other means, from state inspection absent authorization by law.

Article 38 makes personal residences immune from entry or search without the owner's permission or a court order, subject only to an evident crime exception under which the responsible official must still obtain a court order after the fact, within the time limit set by law.

Neither article defines personal data, sets processing conditions, or establishes a supervisory authority; both are bare constitutional rights enforceable against the state rather than a comprehensive data protection regime, the same shape as the constitutional privacy provisions of Timor-Leste and Palestine elsewhere in this corpus.

On 4 and 7 January 2026 the Taliban administration promulgated a wholly new Criminal Procedure Code and Penal Principles of Taliban Courts (119 articles), effective immediately with no public consultation, which multiple independent outlets describe as replacing the prior penal architecture and further undermining the 2004 Constitution's operative status; that framework's text is unpublished, so its treatment of personal data is unknown, and no published instrument repeals or supersedes Articles 37 or 38, so this instrument stays coded in effect.

What it requires

Scraping law1 instrument, 1 in force

Research summary (303 words)

Afghanistan has no scraping-specific statute, so general law governs each dimension separately.

The Penal Code of Afghanistan (2017), Part Twelve, Chapter One, Article 852 punishes accessing a computer, program, or data of a computer system belonging to someone else without authorization, and the article states no requirement that the offender infringe a security measure to gain access; no reported Afghan case construes whether reading a public, unauthenticated page falls within or outside that term, so open-web crawling of a public page is unsettled rather than clearly permitted or clearly prohibited.

No Afghan court decision addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.

The Law Supporting the Rights of Authors, Composers, Artists and Researchers (Copyright Law), 2008 protects a broad range of works and lets a natural person reproduce a published work, including all or part of a database, without the author's authorization, but only for that person's own personal use; the Law has no text-and-data-mining exception reaching institutional or commercial use, and its Article 8 exclusion from protection does not separately name facts or the news of the day.

No provision here creates a sui generis database right distinct from the general copyright regime, and Afghanistan has no general personal-data-protection statute reaching a scraper's collection of personal data from a public Afghan webpage. No statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Multiple independent outlets report that the Taliban administration promulgated a new Criminal Procedure Code and Penal Principles of Taliban Courts in January 2026 said to replace the prior penal architecture; no source locates that framework's text, and no formal repeal of the 2017 Penal Code's cybercrime chapter has been located, so it remains coded in effect on that basis.

Computer misuse

Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment)

Penal Code of Afghanistan (2017), Part Twelve, Chapter One (Cyber Crimes and Punishment), arts. 851-859English translation of the Penal Code of Afghanistan (2017)

In force since 15 February 2018. Binds public and private bodies.

What this law does

Article 851 defines a cybercrime as a crime committed through modern information technology, electronic communications, or the internet in cyberspace.

Article 852 punishes a person who accesses a computer, program, or data of a computer system belonging to someone else without authorization with short imprisonment, with an additional penalty where the access causes physical, non-physical, or financial damage; the article states no requirement that the offender circumvent a security measure to gain access.

Articles 853, 854, 856, 857, 858, and 859 each punish, with medium imprisonment or a cash fine of 60,000 to 300,000 Afghanis, unauthorized alteration of a computer system's functionality (including installing a virus or unauthorized hacking of network traffic), unauthorized destruction of a computer system, program, or data, unauthorized hijacking that prevents data transmission, producing or supplying software or a password for use in one of these offenses, electronic forgery of a computer's original setting, and electronic deception to access a computer system, program, or data.

Article 855 separately punishes disclosing a password, access code, or other means of access to a program, computer system, or data without authorization, with a cash fine equal to twice the benefit gained or loss inflicted. Article 916 ties the Penal Code's entry into force to nine months after its publication in the Official Gazette. The Gazette published the Code as issue number 1260 on 15 May 2017.

What it requires

News aggregation law1 instrument, 1 in force

Research summary (155 words)

Afghanistan has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability.

The Law Supporting the Rights of Authors, Composers, Artists and Researchers (Copyright Law), 2008, Article 42 lets the press or other information media publish, without the author's authorization, speeches, lectures, legal proceedings, or similar works already displayed openly to the public, provided the author's name is indicated; the provision does not reach a competitor publisher's own news reporting the way a headline or snippet press-review exception would, and no reported Afghan decision applies it to a systematic news aggregator.

The Copyright Law's Article 8 does not separately exclude facts or the news of the day from protection, unlike some neighbouring statutes, and the Law predates the concept of a machine-readable text-and-data-mining reservation entirely, so no opt-out mechanism of that kind exists.

Snippet reproduction

Copyright Law, Public Broadcasting of Work Exception

Law Supporting the Rights of Authors Composers, Artists and Researchers (Copyright Law), 2008 (Decree No. 54), art. 42 (Public Broadcasting of Work)Law Supporting the Rights of Authors

In force. Binds public and private bodies.

What this law does

Article 42 lets the press or other information media publish, without the author's authorization, speeches, lectures, legal proceedings, or similar works displayed openly to the public, provided the author's name is clearly indicated; the provision is narrower than a general press-review or quotation exception because it reaches only material already displayed openly to the public, such as a public address or a court proceeding, rather than a competitor publisher's own news reporting.

Article 8 excludes from protection any work that is in contradiction with the provisions of the Law, and denies protection to the copyright in preexisting material embedded in a derivative work, but it does not separately exclude facts or the news of the day the way some neighbouring statutes do.

Article 39(1) permits a natural person to reproduce a published work, including reproducing all or part of a database digitally, without the author's authorization, but only for that person's own personal use, so this exception does not reach an aggregator's systematic, publicly distributed reproduction.

Article 49 ties the Law's entry into force to its publication in the Official Gazette, but the sources located here give only the date the President signed the enacting decree (21 July 2008), not the Gazette's publication date.

Note and primary source

This page covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.