Penal Code Art. 154-A, Invasion of a Computing Device
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 28 May 2021.
A computer misuse rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not invade a computing device, connected to a network or not, to obtain, alter, or destroy data or information without the device user's authorization, or to install a vulnerability to obtain an unlawful advantage.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this article.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Reclusão of 1 to 4 years and a fine for invading a device (caput); reclusão of 2 to 5 years and a fine where the invasion yields private communications, trade or industrial secrets, confidential information, or unauthorized remote control (§ 3º); the penalty for either tier increases by 1/3 to 2/3 for resulting economic loss (§ 2º), by 1/3 to 2/3 for disclosure, sale, or transmission of the obtained material to a third party (§ 4º), and by 1/3 to 1/2 where the victim is the President, a governor, a mayor, or specified other officials (§ 5º).
What it reaches
Obligation class
Access restriction
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 154-A punishes invading another person's computing device, whether or not connected to a network, to obtain, alter, or destroy data or information without the device user's express or tacit authorization, or to install a vulnerability to obtain an unlawful advantage, with reclusão of 1 to 4 years and a fine under the wording Lei nº 14.155/2021 gave the offense, up from the original Lei nº 12.737/2012 penalty of detention of 3 months to 1 year and a fine.
Section 2 raises the penalty by one third to two thirds if the invasion causes economic loss.
Section 3 sets a separate penalty of reclusão of 2 to 5 years and a fine where the invasion obtains the content of private electronic communications, trade or industrial secrets, confidential information as defined by law, or unauthorized remote control of the invaded device, and section 4 raises that penalty by one third to two thirds where the obtained material is disclosed, marketed, or transmitted to a third party.
Because the offense's trigger is invading a device, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.
When LexLint raises it
crawls_webtrains_models
Read the law
Official compiled text of the Penal Code, Decreto-Lei nº 2.848/1940, Presidência da República