Cybercrimes Act, unlawful access and unlawful interception of data
Cybercrimes Act 19 of 2020, ss. 2 (unlawful access) and 3 (unlawful interception of data)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 December 2021.
A computer misuse rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not unlawfully and intentionally access a computer system or data storage medium.
- Do not unlawfully and intentionally intercept data, or possess data known or reasonably suspected to have been unlawfully intercepted, without a satisfactory exculpatory account.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate these sections.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A contravention of section 2(1) or (2) carries a fine or imprisonment of up to five years, or both, and a contravention of section 3(1) or (2) carries a fine or imprisonment of up to ten years, or both (s. 19(1)-(2)); the Act leaves the fine amount to the convicting court rather than fixing a monetary cap.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 2 makes it an offence to unlawfully and intentionally perform an act in respect of a computer system or data storage medium that places a person in a position to commit an access, interception, tool, or interference offence, and separately makes it an offence to unlawfully and intentionally access a computer system or data storage medium; a contravention carries a fine or imprisonment of up to five years under section 19(1).
Section 3 makes it an offence to unlawfully and intentionally intercept data, including electromagnetic emissions from a computer system carrying it, or to possess data known or reasonably suspected to have been unlawfully intercepted without a satisfactory exculpatory account; a contravention of section 3(1) or (2) carries a fine or imprisonment of up to ten years under section 19(2).
Both offences require the access or interception itself to be unlawful, so a plain reading does not by itself capture reading a public, unauthenticated page that defeats no access control. The Act's Schedule repealed sections 85 to 88 of the Electronic Communications and Transactions Act 25 of 2002, the earlier statute that had carried South Africa's computer-misuse offences.
When LexLint raises it
crawls_webtrains_models
Read the law
Cybercrimes Act 19 of 2020, Government Gazette No. 44651 text