Cyber Crimes Act, 2025, unauthorised access to computer system and data
Cyber Crimes Act, 2025 (Act No. 4 of 2025), s. 3
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 12 May 2025.
A computer misuse rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not infringe a security measure to access or monitor a computer system, or any part of one, belonging to another person without lawful authority or in excess of authority.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this section.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of up to five hundred thousand penalty units (ZMW 200,000) or imprisonment of up to five years, or both, on conviction (s. 3(2)).
Penalty structure
Stated in the Act as five hundred thousand penalty units, valued at ZMW 0.40 each under the Fees and Fines (Fee and Penalty Unit Value) (Amendment) Regulations, 2024; the same subsection also allows imprisonment of up to five years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- ZMW
- Fixed cap
- 200,000
What it reaches
Obligation class
Access restriction
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 3(1) prohibits intentionally and without lawful authority or in excess of authority, infringing a security measure to access or monitor a computer system, or any part of a computer system, of another person. Contravention carries a fine of up to five hundred thousand penalty units, valued at ZMW 0.40 each since 19 April 2024 (ZMW 200,000), or imprisonment of up to five years, or both.
Because the offence's trigger is infringing a security measure, a person who reads a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision. This section narrows the unauthorised-access offence it replaced: section 49 of the repealed Cyber Security and Cyber Crimes Act, 2021 penalised accessing or intercepting data without authority or exceeding authorised access, with no express requirement to infringe a security measure.
When LexLint raises it
crawls_webtrains_models
Read the law
Official Act text, ZambiaLII (Zambia Legal Information Institute)