Code penal, Computer Misuse Offences (Unauthorized Access, Interference, Data Introduction, Devices, Attempt, Association)

C.pen. arts. 509-1 a 509-7

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force.

A computer misuse rule binding public and private bodies.

As of 6 September 2026.

What it requires

Do not fraudulently access or remain in all or part of an automated data-processing or transmission system located in Luxembourg.
Do not intentionally interfere with, falsify, or introduce, suppress, alter or intercept data in an automated data-processing or transmission system, to the prejudice of another person's rights.
Reading a public, unauthenticated page without defeating any access control has not itself been held to violate these provisions.
Escalated penalties apply where unauthorized access or interference results in a transfer of money or monetary value for economic gain, and to producing, selling or holding a device or electronic key intended to commit these offences.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Fraudulent access to or remaining in a computer system draws two months to two years of imprisonment and a fine of 500 to 25,000 euros, or either penalty alone, rising to four months to two years and 1,250 to 25,000 euros where data is suppressed or modified or the system's functioning is altered (art. 509-1). Interference with a system's functioning and the intentional introduction, suppression, modification or interception of its data draw three months to three years and 1,250 to 12,500 euros (arts. 509-2 and 509-3). Where any of these offences causes a transfer of money or monetary value for economic gain, or involves producing, selling, holding, importing, distributing or making available a device or electronic key intended to commit them, the penalty rises to four months to five years and 1,250 to 30,000 euros (arts. 509-4 and 509-5). Attempt and participation in an association formed to commit these offences draw the same penalty as the completed offence, or the most severely punished offence within the association's object (arts. 509-6 and 509-7).

Penalty structure

30,000 euros is the ceiling of the most severe tier, articles 509-4 and 509-5 (also carrying four months to five years of imprisonment), for an aggravated offence involving a money transfer or a device or key intended to commit these offences. The base offence under article 509-1 carries a lower ceiling of 25,000 euros (two months to two years, or four months to two years where data is altered), and articles 509-2 and 509-3 carry 12,500 euros (three months to three years).

Rule: Fixed only
As of: 6 September 2026
Currency: EUR
Fixed cap: 30,000

What it reaches

Obligation class

Prohibition

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 509-1 punishes fraudulently accessing or remaining in all or part of an automated data-processing or transmission system with two months to two years of imprisonment and a fine of 500 to 25,000 euros, rising to four months to two years and 1,250 to 25,000 euros where data is suppressed or modified or the system's functioning is altered.

Because the offence's trigger is fraudulent access, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision. Article 509-2 punishes intentionally interfering with or falsifying a system's functioning, and article 509-3 punishes intentionally introducing, suppressing, altering or (since a 2014 amendment) intercepting its data, each with three months to three years of imprisonment and 1,250 to 12,500 euros.

Article 509-4 raises the penalty to four months to five years and 1,250 to 30,000 euros where any of these offences causes a transfer of money or monetary value for economic gain, and article 509-5 punishes producing, selling, holding or distributing a device or electronic key intended to commit these offences at the same level. Attempt and participation in an association formed to commit these offences are punished the same as the completed offence, under articles 509-6 and 509-7.

When LexLint raises it

crawls_web
trains_models

Read the law

Code penal
official text reproduced with commentary by CIRCL (Computer Incident Response Center Luxembourg), the state-mandated computer emergency response team

Back to the example · Lint your app